The vulnerability is a Function Call With Incorrect Argument Type in the sensor interface of Junos OS Evolved. When SRTE policy tunnels are provisioned via PCEP and a gRPC query is received, the evo-aftmand process crashes and does not automatically restart, causing a persistent denial of service. An attacker who has authenticated network access with low privileges can trigger the crash by sending gRPC traffic that includes an Originator ASN value larger than 65,535. The resulting service disruption requires a manual reboot to recover, affecting traffic monitoring and overall network operation. The weakness is classified as CWE‑686, indicating a function call with an incorrect argument type.

Affected systems are Juniper Networks Junos OS Evolved running on PTX Series devices. The vulnerability is present in all releases before 22.4R3‑S9‑EVO, before 23.2R2‑S6‑EVO, before 23.4R2‑S7‑EVO, before 24.2R2‑S4‑EVO, before 24.4R2‑S2‑EVO, and before 25.2R1‑S2‑EVO; all later releases address the issue.

The CVSS score of 7.1 indicates a moderate to high impact, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated attacker with low privileges who can interact with the router’s PCEP and gRPC interfaces; the attack vector is therefore likely network-based and necessitates some level of internal access. Given the impact on service continuity, the risk to organizations deploying the affected Junos OS Evolved versions is significant, especially in environments where SRTE tunnels are used.