Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Juniper Junos may restart when BGP L2VPN data is malformed

CVE-2016-1270 · published 10 years ago
Summary

Versions of Juniper Junos that run the rpd process can be forced to stop and restart if they receive specially crafted BGP updates used for L2VPN or VPLS services. This causes a temporary loss of network connectivity. Update to the latest Junos release or apply the vendor’s patch to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
juniper junos <= 12.1x44
12.1x46
12.1x47
12.3
12.3x48
13.2
13.2x51
13.3
14.1
14.2
cpe:2.3:o:juniper:junos:*:d55:*:*:*:*:*:*
Original advisory text
The rpd daemon in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13....
The rpd daemon in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R6, 14.1 before 14.1R4, and 14.2 before 14.2R2, when configured with BGP-based L2VPN or VPLS, allows remote attackers to cause a denial of service (daemon restart) via a crafted L2VPN family BGP update.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-19Data Processing Errors
Timeline
Published15 Apr 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-1270 · NVD
Track software like this
Free during beta