A NULL Pointer Dereference occurs in the routing process (rpd) of Junos OS and Junos OS Evolved when a malicious RSVP Path message is received on an EVPL LMP control channel. The flaw causes the rpd process to crash, leading to a routing-process shutdown and loss of network routing capability. The primary impact is the availability of routing services; the crashed process can bring down entire routing instances, resulting in widespread connectivity problems for devices that rely on the affected router.

The vulnerability applies to Juniper Networks Junos OS and Junos OS Evolved. Fixed releases include Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases; and Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases. Earlier versions of those releases have respin updates that patch the issue.

The CVSS score of 7.1 indicates a high severity risk. EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet have known public exploits. The vulnerability requires an attacker to send a crafted RSVP Path message on an EVPL LMP control channel, implying the attacker must be adjacent or otherwise able to communicate over the control plane of the affected device. Successful exploitation leads to a routing-process crash and a denial of service affecting all routes managed by that process. Although no workaround exists, the required access level reduces the likelihood of widespread exploitation.