An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Juniper Networks Junos OS Evolved 24.4R2‑EVO and 25.2 series on PTX Series and affects the advanced forwarding toolkit (evo‑aftmand). The flaw allows an attacker to continuously send ECMP routing updates that create unilist ECMP routes; the router processes these updates incorrectly, corrupting internal state and causing the evo‑aftmand process to crash, which results in a denial‑of‑service that requires a reboot or FPC restart to recover. The failure is triggered by a sequence of events that are largely outside the attacker’s direct control, meaning the attacker may need to rely on normal routing protocol exchanges or injection of malformed updates to trigger the unilist behavior.

The affected vendor is Juniper Networks and the product is Junos OS Evolved PTX Series. Vulnerable releases include any 24.4R2‑EVO version earlier than 24.4R2‑S3‑EVO and any 25.2 version earlier than 25.2R2‑EVO.

The CVSS score of 8.2 indicates high severity. The EPSS score, being less than 1%, suggests a very low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is network‑based and requires an unauthenticated attacker to continuously inject ECMP routing updates that create unilist ECMP routes. Successful exploitation also depends on specific routing protocol events that are not entirely controllable by the attacker, which may limit the practicality of the attack.