The vulnerability arises from an improper validation of specified quantities in the input received by the rpd process. When a malformed RIPv2 message is processed, the routing daemon can crash, resulting in a loss of routing functionality on the affected device. This denial‑of‑service condition is triggered by an unauthenticated adjacent attacker crafting a malicious RIPv2 packet. The weakness is identified as CWE‑1284, indicating a failure in input validation that can be exploited without prior authentication. The effect is that the router’s routing service becomes unavailable, potentially disrupting traffic forwarding and network connectivity for all hosts that rely on the affected device.

Affected products are Juniper Networks’ Junos OS and Junos OS Evolved. Devices running any Junos OS release from 23.2R2‑S7.7 onward, including 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all subsequent releases, are impacted. Junos OS Evolved releases from 23.2R2‑S7.7‑EVO onward, including 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases, are affected. Specific respins are available for earlier 23.2, 23.4, and 24.2 releases.

The CVSS score of 7.1 indicates a high severity denial‑of‑service risk that can be triggered by an unauthenticated adjacent attacker sending crafted RIPv2 packets. The EPSS score of < 1 % indicates an extremely low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalogue, suggesting no publicly known exploit as of the assessment. Successful exploitation requires proximity to the target router and the ability to transmit a malformed RIPv2 message that activates the vulnerable input‑validation logic in the routing daemon.