An uninitialized resource in the Internal Device Manager of Juniper Networks Junos OS on EX4000 models causes a crash and reboot when the device receives a high volume of traffic aimed at it. The fault can be triggered by any unauthenticated network actor that sends sufficient traffic, resulting in a firmware failure and a full service outage until the system restarts. The primary consequence is a Denial-of-Service that affects network availability for all services running on the device.

Vulnerable devices are Juniper Networks Junos OS running on EX4000-48T, EX4000-48P, and EX4000-48MP switches. Firmware versions 24.4 prior to 24.4R2 and 25.2 prior to 25.2R1‑S2 or 25.2R2 contain the flaw. All releases equal to or newer than 24.4R2, 25.2R1‑S2, 25.2R2, 25.4R1 or later have been patched. Earlier releases before 24.4R1 are unaffected because the platform first introduced Junos OS 24.4R1.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score is below 1%, indicating that exploitation likelihood is low at present, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, the flaw is network‑based and requires no authentication, which means an attacker can craft a DoS attack by flooding the device with traffic. If executed, the device will crash, restart, and cease to provide routing services until the reboot completes. Immediate remediation is required to prevent potential outages.