An improper resource locking flaw in Juniper’s clksyncd daemon on MX Series routers allows an unauthenticated, logically adjacent attacker to send a malformed SyncE or PTP packet. The race condition triggers a false 19.44 MHz alarm on the master RE, which forces persistent RE switchovers and repeatedly crashes the clksyncd process. While it does not grant direct control, the resulting cascaded failures can disrupt routing, degrade service availability, and affect traffic that traverses the device.

Juniper Networks Junos OS operating on MX Series routers. All builds preceding 23.2R2‑S7.7; 23.4 releases prior to 23.4R2‑S8.13; 24.2 before 24.2R2‑S5.5; 24.4 before 24.4R2‑S4; 25.2 before 25.2R2‑S1; 25.4 before 25.4R1‑S2.

The CVSS score of 6.0 indicates moderate severity. With an EPSS score below 1% and no listing in the CISA KEV catalog, the chance of exploitation is low, though not zero. The attack requires network proximity to the SyncE/PTP interface, which can be achieved by a physically or logically adjacent device. A successful exploit would repeatedly trigger RE switchovers and clksyncd crashes, leading to sustained disruptions in routing and connectivity.