The vulnerability is an improper validation of syntactically correct input in the IPsec library used by Juniper’s kmd and iked processes. When a malformed first ISAKMP packet is received from an initiator, the kmd/iked service crashes and restarts. This crash temporarily blocks the establishment of new security associations, and repeated exploitation can lead to a complete inability to form new VPN connections, effectively causing a denial of service. The flaw permits an unauthenticated, network‑based attacker to trigger the reset without needing any privileged access.

Juniper Networks Junos OS on SRX Series and MX Series devices are affected. Any release prior to 22.4R3‑S9, 23.2R2‑S6, 23.4R2‑S7, 24.2R2‑S4, 24.4R2‑S3, or 25.2R1‑S2/25.2R2 is vulnerable. All subsequent releases contain the correction and are immune.

The CVSS base score of 8.7 indicates high severity, though EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based and does not require authentication, so any host within the device’s reach could send a crafted IKE packet to trigger a crash. Because the flaw causes a DoS condition, the risk to service availability is significant, especially for organizations relying on SRX or MX series VPN connectivity.