A function call that passes an incorrect variable to the routing protocol daemon enables an unauthenticated, adjacent attacker to trigger a crash of the rpd process on Juniper Networks devices. Because rpd handles routing information, its abrupt termination can render the device unable to perform normal routing or may cause the routing table to become unreachable, effectively disrupting network connectivity for users attached to that device. This type of failure corresponds to a denial-of-service condition and is classified under CWE-688.

The vulnerability affects Juniper Networks’ Junos OS and Junos OS Evolved platforms. For Junos OS, all releases prior to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and any subsequent releases that have not applied the specified respins are affected. For Junos OS Evolved, releases prior to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, or any subsequent releases that lack the specific respins also remain vulnerable.

The CVSS score of 7.1 indicates a moderate severity, while the EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The vulnerability requires an unauthenticated attacker to be on a network segment adjacent to the affected Juniper device. No workaround guidance is provided, so relief depends solely on deploying the patched firmware. The risk persists until the firmware is updated or the device is isolated from adjacent hosts.