Junos OS Evolved contains a Reachable Assertion flaw in the fwstatsd process that can be triggered by an SNMP firewall-counter MIB query. An attacker who authenticates to the device can cause the system to crash, leading to a loss of service. The vulnerability impacts the availability of the router but does not directly compromise confidentiality or integrity of data.

The flaw affects Juniper Networks Junos OS Evolved on the versions listed in the vendor’s advisory: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases. Devices running earlier releases of these major versions have been rebuilt to address the issue.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation in the wild. Attackers must first authenticate to the device and must issue an SNMP firewall-counter query; therefore the attack requires network-level access with SNMP privileges. Given the high impact and the attacker’s need for authentication, the risk is significant, but not automatically exploitable by unauthenticated threats.