CVE-2024-39554 is a race condition vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved, specifically when BGP multipath is enabled. An unauthenticated, network-based attacker can exploit this timing issue to inject incremental routing updates, causing rpd to crash and restart, leading to a Denial of Service (DoS). While successful exploitation is difficult due to its timing-dependent nature, sustained receipt of malicious packets can create a persistent DoS. This vulnerability has a CVSS score of 5.9 (Medium) due to its network attack vector and high impact on availability, but its high attack complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 21.1, < 21.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | ||
21.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:* | ||
21.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:* | ||
21.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:* | ||
21.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.