A Reachable Assertion vulnerability in the Two‑Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network‑based attacker to send a specific TCP packet that triggers a service disruption of the rmopd daemon. This flaw is a classic instance of CWE‑617, which results in a denial of service by disrupting a critical management service. Because the vulnerability is not tied to authentication or privilege elevation, any device with active TWAMP support can be impacted when exposed to an attacker able to send malformed traffic.

Affected systems include Juniper Networks Junos OS across several major releases. The vulnerability is present in versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all newer releases. For the 23.2, 23.4, and 24.2 lines, specific respins have been referenced, and previous builds of those releases have been patched to address the issue.

The CVSS score of 9.2 indicates a high‑severity denial‑of‑service vulnerability. The EPSS score of < 1% indicates a very low exploitation probability, yet the high CVSS means the impact of a successful attack remains significant. The vulnerability is not listed in CISA’s KEV catalog, and the attack vector is a network‑based, unauthenticated TCP packet sent to a remote TWAMP peer, implying that exposed devices are at risk unless patched or isolated.