The vulnerability originates from a reachable assertion flaw in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved. Devices configured for MC‑LAG/ICCP are affected. An adjacent device that participates in the same MC‑LAG can send an ICCP message that deviates from the expected format, triggering the assertion and causing l2ald to terminate. The crash results in a denial of service on the affected router, interrupting layer‑two forwarding and potentially disrupting traffic across the network. No code execution is facilitated; the impact is purely availability.

Juniper Networks Junos OS and Junos OS Evolved are impacted. The fix has been integrated into the following releases: Junos OS 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.2R2‑S6, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and all later versions; Junos OS Evolved 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.2R2‑S6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and all later releases.

The CVSS score of 7.1 indicates a high severity impact. The EPSS score is below 1 %, indicating a very low likelihood of exploitation at this time, and the issue is not listed in CISA’s KEV catalog. Nonetheless the flaw requires only a nearby device that is part of the same MC‑LAG configuration and the ability to send an ICCP message, which is readily available in shared network segments. Because the vulnerability is an assertion failure, inadvertent trigger is unlikely, but a malicious actor who can control or spoof ICCP traffic can reliably cause a denial of service. No workaround is known, so the safest mitigation is to apply the vendor‑supplied patch or disable MC‑LAG/ICCP.