Junos OS and Junos OS Evolved: An rpd crash occurs when a specific L2VPN command is run

Description

A Reachable Assertion vulnerability in Routing Protocol Daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows a locally-based, low-privileged attacker to cause a Denial of Service (DoS). On all Junos OS and Junos OS Evolved, when a specific L2VPN command is run, RPD will crash and restart. Continued execution of this specific command will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS All versions prior to 19.3R3-S10; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S6; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S2; 21.4 versions prior to 21.4R3; 22.1 versions prior to 22.1R3; 22.2 versions prior to 22.2R2; 22.3 versions prior to 22.3R2; Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S7-EVO; 21.1 versions prior to 21.1R3-S3-EVO; 21.2 versions prior to 21.2R3-S5-EVO; 21.3 versions prior to 21.3R3-S4-EVO; 21.4 versions prior to 21.4R3-EVO; 22.1 versions prior to 22.1R3-EVO; 22.2 versions prior to 22.2R2-EVO; 22.3 versions prior to 22.3R2-EVO;

Timeline

Scores

EPSS (exploitation in 30 days)

0.19% · top 91% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• CWE-617 Reachable Assertion (opens in a new tab)All about CWE-617 and its CVEs
• Denial of Service (DoS)

Affected products

• Juniper Networks · Junos OS

  • affected unspecified – < 19.3R3-S10
  • affected 20.1 – < 20.1R3-S4
  • affected 20.2 – < 20.2R3-S6
  • affected 20.3 – < 20.3R3-S6
  • affected 20.4 – < 20.4R3-S5
  • affected 21.1 – < 21.1R3-S4
  • affected 21.2 – < 21.2R3-S3
  • affected 21.3 – < 21.3R3-S2
  • affected 21.4 – < 21.4R3
  • affected 22.1 – < 22.1R3
  • affected 22.2 – < 22.2R2
  • affected 22.3 – < 22.3R2

• Juniper Networks · Junos OS Evolved

  • affected unspecified – < 20.4R3-S7-EVO
  • affected 21.1 – < 21.1R3-S3-EVO
  • affected 21.2 – < 21.2R3-S5-EVO
  • affected 21.3 – < 21.3R3-S4-EVO
  • affected 21.4 – < 21.4R3-EVO
  • affected 22.1 – < 22.1R3-EVO
  • affected 22.2 – < 22.2R2-EVO
  • affected 22.3 – < 22.3R2-EVO

What to do

Solution: The following software releases have been updated to resolve this specific issue: Junos OS: 19.3R3-S7, 19.4R3-S10, 20.2R3-S6, 20.4R3-S5, 21.1R3-S4, 21.2R3-S3, 21.3R3-S2, 21.4R3, 22.1R3, 22.2R2, 22.3R2, 22.4R1, and all subsequent releases; Junos OS Evolved: 20.4R3-S7-EVO, 21.4R3-EVO, 22.1R3-EVO, 22.2R2-EVO, 22.3R2-EVO, 22.4R1-EVO, and all subsequent releases.

Workaround: This issue can be avoided by using access lists or firewall filters to limit access to the device to only trusted hosts, networks and administrators.

Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

References (1)

• https://supportportal.juniper.net/JSA71647 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-36840](https://trackcve.app/badge/CVE-2023-36840.svg)](https://trackcve.app/cve/CVE-2023-36840)

Record last updated 22 Oct 2024, 14:19 UTC.