An incorrect calculation in the Layer 2 Control Daemon (l2cpd) of Juniper Networks Junos OS Evolved lets an unauthenticated, network‑adjacent attacker repeatedly enable and disable the device’s management interface—known as flapping. This exploitation stops the learning of new MAC addresses on label‑switched interfaces, while flooding system logs and generating sustained high CPU usage. The result is a denial‑of‑service condition that can compromise normal traffic handling on the affected device. The vulnerability is classified as CWE‑682 (Incorrect Calculation).

All Junos OS Evolved releases before 21.4R3‑S7‑EVO, before 22.2R3‑S4‑EVO, before 22.3R3‑S3‑EVO, before 22.4R3‑S2‑EVO, before 23.2R2‑S1‑EVO, and before 23.4R1‑S2‑EVO/23.4R2‑EVO. The official solution lists patched releases 21.4R3‑S7‑EVO, 22.2R3‑S4‑EVO, 22.3R3‑S3‑EVO, 22.4R3‑S2‑EVO, 23.2R2‑S1‑EVO, 23.4R1‑S2‑EVO, 23.4R2‑EVO, 24.2R1‑EVO and all later revisions.

The CVSS score of 7.1 indicates medium‑high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, and no widespread exploits have been reported. Because the attack requires only local network proximity and no authentication, any device with the vulnerable management interface exposed to an untrusted segment faces elevated risk. An attacker that can cause the interface to flap is able to deny service without needing privileged credentials.