CVE-2024-39525: Juniper Junos BGP DoS Vulnerability

CVE-2024-39525 Overview

CVE-2024-39525 is a high-severity Denial of Service (DoS) vulnerability affecting the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated network-based attacker can send a crafted Border Gateway Protocol (BGP) packet that triggers improper exception handling [CWE-755] in rpd, causing the daemon to crash and restart. Sustained delivery of the malicious packet creates a persistent outage. The issue affects both iBGP and eBGP sessions across IPv4 and IPv6, but only systems with BGP traceoptions enabled and an already-established BGP session are vulnerable.

Critical Impact
A single specially crafted BGP packet can crash rpd on vulnerable Junos OS and Junos OS Evolved devices with BGP traceoptions enabled, disrupting routing across iBGP, eBGP, IPv4, and IPv6 sessions.

Affected Products

Juniper Junos OS: all versions before 21.2R3-S8; 21.4 before 21.4R3-S8; 22.2 before 22.2R3-S4; 22.3 before 22.3R3-S4; 22.4 before 22.4R3-S3; 23.2 before 23.2R2-S1; 23.4 before 23.4R2
Juniper Junos OS Evolved: all versions before 21.2R3-S8-EVO; 21.4-EVO before 21.4R3-S8-EVO; 22.2-EVO before 22.2R3-S4-EVO; 22.3-EVO before 22.3R3-S4-EVO; 22.4-EVO before 22.4R3-S3-EVO; 23.2-EVO before 23.2R2-S1-EVO; 23.4-EVO before 23.4R2-EVO
Routing protocol daemon (rpd) component within Junos OS and Junos OS Evolved

Discovery Timeline

2024-10-09 - CVE-2024-39525 published to the National Vulnerability Database (NVD)
2026-01-23 - Last updated in the NVD database

Technical Details for CVE-2024-39525

Vulnerability Analysis

The flaw resides in the routing protocol daemon (rpd), the Junos process responsible for managing routing protocols including BGP. When BGP traceoptions is enabled, rpd logs detailed protocol activity for diagnostic purposes. A specific BGP packet received over an established session triggers an unhandled exceptional condition during trace processing, causing rpd to terminate and restart. Each repeated packet re-triggers the crash, sustaining the Denial of Service condition. Both iBGP and eBGP peers, and both IPv4 and IPv6 address families, are affected.

Root Cause

The root cause is improper handling of an exceptional condition [CWE-755] within the BGP tracing logic. The diagnostic code path invoked when traceoptions is configured fails to validate or safely process a specific malformed input, leading to an unrecoverable fault in rpd. Devices without BGP traceoptions configured do not execute the vulnerable code path and are not affected.

Attack Vector

Exploitation requires network reachability to a vulnerable Junos device with an already-established BGP session. The attacker must be the BGP peer or be in a position to inject traffic into the session. No authentication beyond the existing BGP peering is required, and no user interaction is needed. Once a single crafted packet is sent, rpd crashes; continuous transmission produces a sustained outage that disrupts routing convergence across the affected device.

No verified public exploit code is available for CVE-2024-39525. Refer to the Juniper Security Advisory JSA88102 for vendor-confirmed technical details and the Juniper CLI Reference for BGP for documentation on the traceoptions statement.

Detection Methods for CVE-2024-39525

Indicators of Compromise

Unexpected restarts of the rpd process logged in /var/log/messages or via show system processes extensive
BGP sessions repeatedly flapping or dropping to the Idle or Active state on devices with protocols bgp traceoptions enabled
Core files generated by rpd (rpd.core-tarball.*) appearing on the device shortly after BGP packet reception

Detection Strategies

Audit running configurations for set protocols bgp traceoptions statements on edge and route-reflector devices to identify exposure
Correlate rpd crash events with timestamps of incoming BGP UPDATE or NOTIFICATION messages from specific peers
Monitor BGP session uptime metrics through SNMP or streaming telemetry to detect abnormal session resets

Monitoring Recommendations

Enable centralized syslog collection from all Junos devices and alert on RPD_* crash and restart messages
Track BGP peer flap counts in network performance monitoring tools and trigger alerts on rapid successive resets
Forward Junos telemetry to a SIEM or data lake to baseline normal rpd behavior and surface anomalies tied to specific peers

How to Mitigate CVE-2024-39525

Immediate Actions Required

Identify all Junos OS and Junos OS Evolved devices with protocols bgp traceoptions configured and prioritize them for remediation
Upgrade affected devices to a fixed release listed in Juniper Security Advisory JSA88102
If patching cannot occur immediately, disable BGP traceoptions on production devices until an upgrade is scheduled
Restrict BGP peering to authenticated, known peers and enforce MD5 or TCP-AO authentication on all sessions

Patch Information

Juniper has released fixed software in Junos OS 21.2R3-S8, 21.4R3-S8, 22.2R3-S4, 22.3R3-S4, 22.4R3-S3, 23.2R2-S1, 23.4R2, and later, with equivalent fixes in the corresponding Junos OS Evolved (-EVO) releases. Full version details and download links are published in Juniper Security Advisory JSA88102.

Workarounds

Remove the traceoptions statement from the [edit protocols bgp] hierarchy, which eliminates the vulnerable code path entirely
Limit BGP peering to trusted ASNs and apply infrastructure access control lists (iACLs) that drop BGP traffic from unexpected sources
Where diagnostic tracing is required, enable it only briefly during active troubleshooting and remove the configuration immediately afterward

bash

# Configuration example: remove BGP traceoptions on Junos
configure
delete protocols bgp traceoptions
commit comment "Mitigate CVE-2024-39525 by disabling BGP traceoptions"
exit

# Verify traceoptions is no longer configured
show configuration protocols bgp | match traceoptions