Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled (Juniper Networks Junos OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 16 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Awaiting Analysis
Description
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message.
Weaknesses (CWE)
- CWE-121 — Stack-based Buffer Overflow
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | juniper |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L | juniper |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · sirt@juniper.net (Secondary) |
European references
- ENISA EUVD · EUVD-2026-101416
- GCVE · GCVE-0-2026-101981
CERT-FR advisories
- CERTFR-2026-AVI-1322 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · Junos OS | affected 23.4 < 23.4R2-S8.13 ; affected 24.2 < 24.2R2-S5.5 ; affected 24.4 < 24.4R2-S5 ; affected 25.2 < 25.2R2-S2 ; affected 25.4 < 25.4R1-S3 ; affected 26.2 < 26.2R1-S2 |
| Juniper Networks · Junos OS Evolved | affected 23.4 < 23.4R2-S8.11-EVO ; affected 24.2 < 24.2R2-S5.6-EVO ; affected 24.4 < 24.4R2-S5-EVO ; affected 25.2 < 25.2R2-S2-EVO ; affected 25.4 < 25.4R1-S3-EVO ; affected 26.2 < 26.2R1-S2-EVO |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |