Key points
- The vulnerability is a stack-based buffer overflow in the routing protocol daemon.
- Attackers need only an unauthenticated BGP peer connection to exploit the flaw.
- Successful exploitation can lead to denial of service or root-level command execution.
A critical security flaw in Juniper Networks’ Junos OS allows remote attackers to gain root-level access to routers. The issue arises when the BGP Monitoring Protocol is enabled, letting unauthenticated peers send crafted route updates that trigger a buffer overflow. This weakness, rated 9.8 by the National Vulnerability Database, can also cause denial of service.
In plain English
The routing protocol daemon in Junos OS processes data from Border Gateway Protocol peers. When the BGP Monitoring Protocol is turned on, this daemon handles additional traffic. If an attacker sends specifically crafted route updates, the system fails to handle the data size correctly. This causes a stack-based buffer overflow, which can crash the service or allow the attacker to run commands as root.
The background
The flaw affects multiple versions of Junos OS and Junos OS Evolved. According to the NVD record, systems running versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are vulnerable. For Junos OS Evolved, affected versions are those before 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, and 24.4R2-S5-EVO. The issue is classified under CWE-121.
What changes now
Network operators must verify whether BGP Monitoring Protocol is active on their devices. If it is enabled, the risk of unauthenticated root access is significant. The National Vulnerability Database rates the severity as critical, with a CVSS score of 9.8. Teams should assess their exposure by checking current software versions against the affected list provided in the advisory.
The attacker's path
In this scenario, the attacker exploits a memory corruption weakness to bypass standard controls. Teams usually face challenges when monitoring features are active, as they expand the attack surface. Check whether your environment allows unauthenticated peers to send complex data structures. The goal is to determine if the system can be forced into an unstable state through malformed inputs. Focus on limiting who can interact with routing daemons and ensure that monitoring tools do not inadvertently expose internal processes to external threats without strict validation.
What to do and how to stay safe: Juniper Networks
- Verify if BGP Monitoring Protocol is enabled on any Junos OS devices and disable it if not strictly required.
- Check current software versions against the affected lists to identify if your systems are running vulnerable builds.
- Monitor logs for unusual BGP route updates or unexpected daemon crashes that could indicate exploitation attempts.
- Once the vendor provides an update, apply the patch promptly to mitigate the risk of unauthenticated root access.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-33789?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.8.
Which Junos OS versions are affected?
Versions before 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, and 24.4R2-S5 are affected, along with specific Evolved versions.
Can this be exploited without authentication?
Yes, the vulnerability allows an unauthenticated BGP peer to trigger the buffer overflow and potentially gain root access.
