Juniper fixes SNMP crash bug in Junos OS Evolved

Juniper Networks has shipped fixes for CVE-2026-102023, a denial-of-service bug in Junos OS Evolved that can be set off with an SNMP query.

The trigger is a firewall-counter lookup. The bug sits in fwstatsd, the process that tracks firewall statistics. On a device that has SNMP enabled and at least one firewall filter term with a count action, a query against the firewall-counter MIB can hit an assertion and bring the service down. Juniper's description calls the attacker authenticated; its CVSS vectors list no privileges required. Juniper says it found the issue internally.

Juniper rates it high severity. As the CVE numbering authority for its products, Juniper gives the flaw a CVSS 3.1 base score of 7.5 and a CVSS 4.0 base score of 8.7, according to the CVE.org record. Both scores reflect a network attack that is easy to carry out and hits availability only, with no effect on confidentiality or integrity.

Patched builds are available. Juniper lists these Junos OS Evolved releases as fixed: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO and 26.4R1-EVO, plus later releases. The 23.4X100 line is listed as affected with no fixed build named. For the 23.2, 23.4 and 24.2 trains, Juniper says it rebuilt previously published versions as respins.

There is no workaround. Juniper says no workarounds are known, so upgrading is the fix. Details are in Juniper advisory JSA112250.