Junos Os
Monthly
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticated attackers to trigger complete management plane denial-of-service via rapid NETCONF session cycling. Vulnerability causes mgd processes to hang in lockf state, exhausting process pool and preventing administrative logins. Recovery requires device power-cycle. Affects deployments using NETCONF management interface with authenticated remote users. No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
Improper handling of a length parameter in the L2ALM component of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to read stale packet memory from the Packet Forwarding Engine (PFE) by sending crafted VXLAN overlay-ping traffic to a local VXLAN tunnel endpoint (VTEP). Only devices configured as VTEPs with overlay-ping processing active are exposed, and the attacker must share Layer-2 adjacency with the target, so the flaw is not reachable across routed or Internet paths; impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Per the vendor, patches are available; the assigned CVSS 4.0 base score is 5.3, and our independent assessment rates it as a medium-severity information-disclosure issue whose real-world priority is modest and bounded by its adjacency and configuration prerequisites.
Memory exhaustion denial of service in Juniper Networks Junos OS and Junos OS Evolved running on QFX5K-family platforms allows a device that is already a configured EVPN peer to leak memory in the l2ald process by driving EVPN-VXLAN active-active multihoming route processing, eventually starving the daemon and degrading or knocking over the switch. This is a medium-severity, availability-only issue (CVSS 6.9; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no data disclosure or modification; there is no public exploit identified at time of analysis, though the assessed vector requires the attacker to hold an established EVPN peering relationship within the fabric rather than being an arbitrary internet host. A vendor patch is available, so only unpatched QFX5K devices with EVPN-VXLAN active-active multihoming configured and reachable by a peer are exposed.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a NULL pointer dereference in the na-grpcd process, which crashes when it receives a crafted network message, making the services that depend on that daemon unavailable on the affected device. Exploitation requires network reachability into the chassis-internal (control-plane fabric) network, which is not normally exposed to WAN or ordinary management networks, so real-world exposure is limited; the advisory describes an unauthenticated attacker while the published CVSS 4.0 vector lists PR:H, leaving the precise account-level requirement ambiguous - the concrete gating condition is privileged access to the internal chassis network. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed software under advisory JSA112187.
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Out-of-bounds read in the rpd routing process of Juniper Junos OS and Junos OS Evolved allows an adjacent attacker to disclose limited rpd process memory and disrupt a single LDP adjacency via a crafted IPv6 LDP message. The flaw affects numerous Junos OS and Evolved branches, with fixed versions available per Juniper advisory JSA112187. No public exploit code has been identified at time of analysis; exploitation requires the target to have LDP with IPv6 enabled and an attacker on the same network segment, making this a moderate-severity, limited-impact issue.
An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A malformed BGP-LS UPDATE message can cause the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) to leak small amounts of heap memory to an adjacent, already-peered BGP-LS speaker. Only devices that have an established BGP-LS session with the traffic-engineering address family explicitly enabled are exposed, and the attacker must itself be a configured BGP-LS peer, so this is not reachable by arbitrary remote hosts and is not a default configuration. Impact is limited to low-severity confidentiality loss (CVSS 3.1, AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect, no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status.
Memory disclosure and denial of service in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved can be triggered by malformed ICCP packets, allowing an attacker with adjacent access to an established Inter-Chassis Communication Protocol peer session to leak memory contents and disrupt the daemon. The vendor-rated CVSS 4.3 (Medium) reflects impact limited to confidentiality and availability, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, with the caveat that exploitation requires the device to be running a multichassis configuration that actively uses ICCP (for example MC-LAG) and that the attacker be logically adjacent on the inter-chassis control plane; standalone routers without ICCP are unaffected. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), so this is a genuinely low-to-moderate priority issue consistent with its 4.3 score, though the memory disclosure component means it should not be dismissed purely on availability impact.
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network attackers by allowing a specially formatted URL to evade the URL filtering plugin. The flaw stems from incorrect name or reference resolution (CWE-706), causing the router to forward traffic that security policy mandates be dropped. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 6.9 carries an Automatable:Yes modifier, indicating the bypass is scriptable at scale against any qualifying deployment.
Ingress firewall filter bypass in Juniper Networks Junos OS on MX Series hardware (MPC10/11, LC4800/9600/4802, MX304) allows adjacent subscribers on static interfaces to evade configured protocol-level access controls and upstream bandwidth limitations. The Packet Forwarding Engine (PFE) fails to enforce ingress filters for these subscriber configurations, meaning neither protocol restrictions nor rate-limiting policies take effect. No public exploit code has been identified and the vulnerability is absent from CISA KEV, though the CVSS 4.0 AU:Y (Automatable) supplemental metric indicates exploitation could be scripted at scale against affected broadband aggregation deployments.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a local, low-privileged attacker to crash the l2ald (Layer 2 Address Learning Daemon) by issuing a specific 'show l2-learning' CLI command, disrupting all Layer 2 services until the process automatically restarts. The root cause is a Return of Pointer Value Outside of Expected Range flaw (CWE-466) in the fileio library. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA or the vendor.
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that assigns duplicate index values to new peers, triggering continuous iked process crashes and a full VPN service outage requiring system reboot. Unauthenticated network-based attackers can deliberately flood the device with failing VPN negotiations to accelerate the rollover condition. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable, zero-privilege attack vector makes this a meaningful risk for any organization relying on Juniper-based VPN infrastructure with iked enabled.
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes the process when handling crafted network requests, taking down all web-management-dependent services including J-Web, remote-access VPN, and firewall authentication until automatic process recovery. Exploitation is gated on a specific non-default configuration - remote-access VPN with pre-logon compliance check enabled - limiting the exposed population to SRX deployments that actively use this feature. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the official CVSS 5.3 score reflects the limited, reversible availability-only impact.
Junos OS on Juniper EX Series access switches exposes a missing authorization flaw in the CLI that allows any locally authenticated user, regardless of privilege class or assigned permissions, to execute a specific privileged 'request' command and cause complete traffic disruption on the affected switch. Affected platforms span EX2300, EX4000, EX4100, EX4300-MP, and EX4400 across six active Junos OS release trains from 23.2 through 25.4. No public exploit has been identified at time of analysis and the system recovers automatically, but the low barrier to exploitation - any authenticated local user qualifies - makes this a meaningful insider threat in shared-access or multi-tenant switch environments.
Packet forwarding engine (pfe) in Juniper Networks Junos OS on EX4100, EX4400, EX4650, and QFX5120 devices fails to correctly initialize egress filters on IRB and physical interfaces, allowing unauthenticated network-based attackers to bypass security policies and cause integrity impact by forwarding traffic that should be blocked. The vulnerability affects Junos OS versions 23.4R2-S6 and 24.2R2-S3. EPSS score of 6.9 reflects moderate exploitation probability; no active exploitation confirmed (non-KEV status).
Denial of service in Juniper Junos OS chassis control daemon (chassisd) on SRX1600, SRX2300, and SRX4300 devices allows local attackers with low privileges to trigger a complete crash via a specific 'show chassis' CLI command, causing temporary traffic disruption until module recovery. Junos OS 24.4 versions before 24.4R1-S3 and 24.4R2 are affected; no public exploit code identified at time of analysis.
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-based line cards running Junos OS Evolved. Missing authentication in critical command processing functions enables authenticated administrators with elevated privileges to bypass access controls and execute commands as root on affected hardware modules including MPC7-11, LC2101/2103, LC480/4800/9600, MX304 built-in FPC, MX-SPC3, SRX5K-SPC3, EX9200-40XS, and PTX-series line cards. No public exploit identified at time of analysis.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticated attackers to trigger complete management plane denial-of-service via rapid NETCONF session cycling. Vulnerability causes mgd processes to hang in lockf state, exhausting process pool and preventing administrative logins. Recovery requires device power-cycle. Affects deployments using NETCONF management interface with authenticated remote users. No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
Improper handling of a length parameter in the L2ALM component of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to read stale packet memory from the Packet Forwarding Engine (PFE) by sending crafted VXLAN overlay-ping traffic to a local VXLAN tunnel endpoint (VTEP). Only devices configured as VTEPs with overlay-ping processing active are exposed, and the attacker must share Layer-2 adjacency with the target, so the flaw is not reachable across routed or Internet paths; impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Per the vendor, patches are available; the assigned CVSS 4.0 base score is 5.3, and our independent assessment rates it as a medium-severity information-disclosure issue whose real-world priority is modest and bounded by its adjacency and configuration prerequisites.
Memory exhaustion denial of service in Juniper Networks Junos OS and Junos OS Evolved running on QFX5K-family platforms allows a device that is already a configured EVPN peer to leak memory in the l2ald process by driving EVPN-VXLAN active-active multihoming route processing, eventually starving the daemon and degrading or knocking over the switch. This is a medium-severity, availability-only issue (CVSS 6.9; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no data disclosure or modification; there is no public exploit identified at time of analysis, though the assessed vector requires the attacker to hold an established EVPN peering relationship within the fabric rather than being an arbitrary internet host. A vendor patch is available, so only unpatched QFX5K devices with EVPN-VXLAN active-active multihoming configured and reachable by a peer are exposed.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a NULL pointer dereference in the na-grpcd process, which crashes when it receives a crafted network message, making the services that depend on that daemon unavailable on the affected device. Exploitation requires network reachability into the chassis-internal (control-plane fabric) network, which is not normally exposed to WAN or ordinary management networks, so real-world exposure is limited; the advisory describes an unauthenticated attacker while the published CVSS 4.0 vector lists PR:H, leaving the precise account-level requirement ambiguous - the concrete gating condition is privileged access to the internal chassis network. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed software under advisory JSA112187.
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Out-of-bounds read in the rpd routing process of Juniper Junos OS and Junos OS Evolved allows an adjacent attacker to disclose limited rpd process memory and disrupt a single LDP adjacency via a crafted IPv6 LDP message. The flaw affects numerous Junos OS and Evolved branches, with fixed versions available per Juniper advisory JSA112187. No public exploit code has been identified at time of analysis; exploitation requires the target to have LDP with IPv6 enabled and an attacker on the same network segment, making this a moderate-severity, limited-impact issue.
An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A malformed BGP-LS UPDATE message can cause the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) to leak small amounts of heap memory to an adjacent, already-peered BGP-LS speaker. Only devices that have an established BGP-LS session with the traffic-engineering address family explicitly enabled are exposed, and the attacker must itself be a configured BGP-LS peer, so this is not reachable by arbitrary remote hosts and is not a default configuration. Impact is limited to low-severity confidentiality loss (CVSS 3.1, AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect, no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status.
Memory disclosure and denial of service in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved can be triggered by malformed ICCP packets, allowing an attacker with adjacent access to an established Inter-Chassis Communication Protocol peer session to leak memory contents and disrupt the daemon. The vendor-rated CVSS 4.3 (Medium) reflects impact limited to confidentiality and availability, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, with the caveat that exploitation requires the device to be running a multichassis configuration that actively uses ICCP (for example MC-LAG) and that the attacker be logically adjacent on the inter-chassis control plane; standalone routers without ICCP are unaffected. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), so this is a genuinely low-to-moderate priority issue consistent with its 4.3 score, though the memory disclosure component means it should not be dismissed purely on availability impact.
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network attackers by allowing a specially formatted URL to evade the URL filtering plugin. The flaw stems from incorrect name or reference resolution (CWE-706), causing the router to forward traffic that security policy mandates be dropped. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 6.9 carries an Automatable:Yes modifier, indicating the bypass is scriptable at scale against any qualifying deployment.
Ingress firewall filter bypass in Juniper Networks Junos OS on MX Series hardware (MPC10/11, LC4800/9600/4802, MX304) allows adjacent subscribers on static interfaces to evade configured protocol-level access controls and upstream bandwidth limitations. The Packet Forwarding Engine (PFE) fails to enforce ingress filters for these subscriber configurations, meaning neither protocol restrictions nor rate-limiting policies take effect. No public exploit code has been identified and the vulnerability is absent from CISA KEV, though the CVSS 4.0 AU:Y (Automatable) supplemental metric indicates exploitation could be scripted at scale against affected broadband aggregation deployments.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a local, low-privileged attacker to crash the l2ald (Layer 2 Address Learning Daemon) by issuing a specific 'show l2-learning' CLI command, disrupting all Layer 2 services until the process automatically restarts. The root cause is a Return of Pointer Value Outside of Expected Range flaw (CWE-466) in the fileio library. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA or the vendor.
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that assigns duplicate index values to new peers, triggering continuous iked process crashes and a full VPN service outage requiring system reboot. Unauthenticated network-based attackers can deliberately flood the device with failing VPN negotiations to accelerate the rollover condition. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable, zero-privilege attack vector makes this a meaningful risk for any organization relying on Juniper-based VPN infrastructure with iked enabled.
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes the process when handling crafted network requests, taking down all web-management-dependent services including J-Web, remote-access VPN, and firewall authentication until automatic process recovery. Exploitation is gated on a specific non-default configuration - remote-access VPN with pre-logon compliance check enabled - limiting the exposed population to SRX deployments that actively use this feature. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the official CVSS 5.3 score reflects the limited, reversible availability-only impact.
Junos OS on Juniper EX Series access switches exposes a missing authorization flaw in the CLI that allows any locally authenticated user, regardless of privilege class or assigned permissions, to execute a specific privileged 'request' command and cause complete traffic disruption on the affected switch. Affected platforms span EX2300, EX4000, EX4100, EX4300-MP, and EX4400 across six active Junos OS release trains from 23.2 through 25.4. No public exploit has been identified at time of analysis and the system recovers automatically, but the low barrier to exploitation - any authenticated local user qualifies - makes this a meaningful insider threat in shared-access or multi-tenant switch environments.
Packet forwarding engine (pfe) in Juniper Networks Junos OS on EX4100, EX4400, EX4650, and QFX5120 devices fails to correctly initialize egress filters on IRB and physical interfaces, allowing unauthenticated network-based attackers to bypass security policies and cause integrity impact by forwarding traffic that should be blocked. The vulnerability affects Junos OS versions 23.4R2-S6 and 24.2R2-S3. EPSS score of 6.9 reflects moderate exploitation probability; no active exploitation confirmed (non-KEV status).
Denial of service in Juniper Junos OS chassis control daemon (chassisd) on SRX1600, SRX2300, and SRX4300 devices allows local attackers with low privileges to trigger a complete crash via a specific 'show chassis' CLI command, causing temporary traffic disruption until module recovery. Junos OS 24.4 versions before 24.4R1-S3 and 24.4R2 are affected; no public exploit code identified at time of analysis.
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-based line cards running Junos OS Evolved. Missing authentication in critical command processing functions enables authenticated administrators with elevated privileges to bypass access controls and execute commands as root on affected hardware modules including MPC7-11, LC2101/2103, LC480/4800/9600, MX304 built-in FPC, MX-SPC3, SRX5K-SPC3, EX9200-40XS, and PTX-series line cards. No public exploit identified at time of analysis.