An Improper Input Validation flaw in the routing protocol daemon (rpd) allows a maliciously crafted BGP VPLS signaling update to cause the rpd process to crash. The vulnerability is triggered when a configured BGP peer sends a VPLS update that contains an automatic site ID. The result is that the router loses routing functionality, BGP sessions drop, and the local network experiences temporary disruption.

The flaw is present in Juniper Networks Junos OS and Junos OS Evolved. Affected releases include, but are not limited to, Junos OS versions 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases, as well as Junos OS Evolved versions 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and later. Specific respins have been issued for the 23.2, 23.4, and 24.2 releases and their evolved counterparts.

The CVSS score of 7.1 indicates a high severity flaw. The EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely, exploitation requires an attacker who can influence a BGP peer that sends a VPLS update with an automatic site ID. By doing so, the attacker can cause a DoS of the routing stack, potentially disrupting network traffic for the affected device.