A Reachable Assertion vulnerability in the Two‑Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network‑based attacker to send a specific TCP packet that triggers a service disruption of the rmopd daemon. This flaw is a classic instance of CWE‑617, which results in a denial of service by disrupting a critical management service. Because the vulnerability is not tied to authentication or privilege elevation, any device with active TWAMP support can be impacted when exposed to an attacker able to send malformed traffic.

Affected systems include Juniper Networks Junos OS across several major releases. The vulnerability is present in versions 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and all newer releases. For the 23.2, 23.4, and 24.2 lines, specific respins have been referenced, and previous builds of those releases have been patched to address the issue.

The CVSS score of 9.2 indicates a high‑severity denial‑of‑service vulnerability. EPSS is not available, so the likelihood assessment is uncertain, but the lack of a known workaround and the fact that it can be triggered by a single crafted packet make it a high‑threat target for attackers. The vulnerability is not listed in CISA’s KEV catalog, yet the attack vector is a network‑based, unauthenticated TCP packet sent to a remote TWAMP peer, implying that exposed devices are at risk unless patched or isolated.