A null pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved can be triggered when a BGP UPDATE is received from a configured peer. If the UPDATE activates an import policy that includes a source‑based‑forwarding statement referencing a routing table that does not exist, the RPD crashes, leading to a loss of routing service and effectively a denial of service for the device. The weakness is a classic NULL pointer dereference (CWE‑476).

All Junos OS and Junos OS Evolved devices running firmware earlier than the releases listed in the CNA solution (for example, Junos OS 23.1 and earlier, and any Junos OS Evolved release prior to 23.2R2‑S7.7‑EVO). The vendor indicates that rev‑spinning specific respins of 23.2, 23.4, and 24.2 are also required for those releases.

The CVSS score of 8.7 classifies this as high severity, indicating that the vulnerability can lead to complete routing service interruption if successfully exploited. EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote BGP; an attacker must be a trusted BGP peer or be able to spoof BGP updates. Because the vulnerability is triggered by policy configuration, an exploit could occur inadvertently if a configuration change is made to refer to a non‑existent routing table. While the potential impact is significant—affecting network availability—the attack requires network access to the router’s BGP session or configuration changes, limiting the ease of exploitation to actors with that capability.