Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.0

A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (D...

CVE-2024-39528 · published 2 years ago
Summary

A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-instance deactivation is triggered, and a...

What to do
  • Update juniper junos to version 21.2 or later.
  • Update juniper junos_os_evolved to version 21.2 or later.
Affected software
VendorProductAffected versions
juniper junos < 21.2
21.2
21.4
22.2
22.3
22.4
23.2
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos_os_evolved < 21.2
21.2
21.4
22.2
22.4
23.2
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*
Original advisory text
A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (D...
A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-instance deactivation is triggered, and at the same time a specific SNMP request is received, a segmentation fault occurs which causes rpd to crash and restart.




This issue affects:

   Junos OS:



* All versions before 21.2R3-S8, 
* 21.4 versions before 21.4R3-S5,
* 22.2 versions before 22.2R3-S3,
* 22.3 versions before 22.3R3-S2,
* 22.4 versions before 22.4R3,
* 23.2 versions before 23.2R2.




  Junos OS Evolved:



* All versions before 21.2R3-S8-EVO,
* 21.4-EVO versions before 21.4R3-S5-EVO,
* 22.2-EVO versions before 22.2R3-S3-EVO, 
* 22.3-EVO versions before 22.3R3-S2-EVO,
* 22.4-EVO versions before 22.4R3-EVO,
* 23.2-EVO versions before 23.2R2-EVO.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.0 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published11 Jul 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-39528 · NVD
Track software like this
Free during beta