Executive brief
A security flaw in Juniper Networks Junos OS Evolved, the operating system used in high-performance networking hardware, allows an internal communication port to be accessed over the public network. An unauthorized attacker could exploit this to gain limited information about the device or slow down its performance by flooding it with traffic. This could lead to minor data exposure and potential service disruptions due to increased processor load.
Technical details
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability (CWE-923) exists in Juniper Networks Junos OS Evolved due to improper initialization. This flaw causes a process intended only for internal device communication to be exposed via an open port reachable over the network. An unauthenticated, network-based attacker can exploit this to achieve limited information disclosure or impact device availability by consuming CPU cycles processing unauthorized ingress packets. The issue is resolved in several maintenance releases including 23.2R2-S7-EVO, 23.4R2-S8-EVO, 24.2R2-S5-EVO, 24.4R2-S4-EVO, 25.2R2-S1-EVO, and 25.4R1-S2-EVO.
Affected products
- Juniper Networks Junos OS Evolved before 23.2R2-S7-EVO, 23.4 before 23.4R2-S8-EVO, 24.2 before 24.2R2-S5-EVO, 24.4 before 24.4R2-S4-EVO, 25.2 before 25.2R2-S1-EVO, 25.4 before 25.4R1-S2-EVO
Timeline
- 2026-07-09: advisory: Initial advisory published by Juniper Networks