Junos OS Extended Echo Integer Underflow Enables Critical Remote DoS on Juniper Networks

Juniper Networks Junos OS contains a critical integer underflow vulnerability in its kernel that can cause a system crash. This defect exists in environments where the Extended Echo feature is actively configured. An attacker positioned on the network can trigger this flaw without needing credentials. The result is a denial of service condition that renders the device unavailable. Security teams must verify their device configurations and software versions immediately.

Root cause

The underlying issue is classified as CWE-191, an integer underflow error. This weakness occurs within the kernel component of the Junos OS. The vulnerability is specifically tied to the processing of traffic related to the Extended Echo feature. When the kernel handles certain inputs for this feature, it performs a calculation that results in an underflow. This arithmetic error leads to a kernel crash. The flaw does not appear to require complex conditions beyond the feature being enabled.

Attack path

An attacker does not need to authenticate to exploit this vulnerability. The attack is network-based, meaning it can be launched from any point with IP connectivity to the target. The attacker sends crafted traffic that triggers the integer underflow in the kernel. This action causes the operating system kernel to crash. The device becomes unresponsive, resulting in a denial of service. The simplicity of the attack vector makes it a high-risk threat for exposed devices.

Affected versions

The vulnerability impacts specific maintenance release branches of Junos OS. Devices running versions before 23.2R2-S7.7 are affected. Systems using versions prior to 23.4R2-S8.13 are also vulnerable. Networks operating on versions before 24.2R2-S5.5 face the same risk. Additionally, devices running versions earlier than 24.4R2-S5 are included in the affected scope. Organizations must check their current version against this list.

Mitigation

• Upgrade Junos OS to version 23.2R2-S7.7 or later for the 23.2 branch.
• Update systems to version 23.4R2-S8.13 or later for the 23.4 branch.
• Install version 24.2R2-S5.5 or later if using the 24.2 branch.
• Move to version 24.4R2-S5 or later for devices on the 24.4 branch.
• Disable the Extended Echo feature if immediate patching is not possible.

Signals worth monitoring

Teams usually observe a sudden loss of connectivity to the device when this type of kernel crash occurs. Check system logs for unexpected reboot events or kernel panic messages. Look for a spike in network traffic immediately preceding the device failure. Verify whether the Extended Echo feature was active on the affected interface. Monitor for repeated connection attempts from unknown sources. Confirm that the device fails to respond to standard management protocols. Review firewall logs for any unusual packet patterns. Ensure that monitoring tools capture the exact time of the crash.

What to do and how to stay safe: Juniper Networks

• Audit your network inventory to identify all devices running Junos OS and check their current version numbers against the affected list.
• Verify if the Extended Echo feature is enabled on any interfaces; if so, disable it temporarily until a patch is applied.
• Apply the recommended software updates to bring devices to a non-vulnerable version as soon as maintenance windows allow.
• Monitor network traffic for signs of exploitation, such as unexpected device reboots or loss of connectivity to critical nodes.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-101980?

The National Vulnerability Database records show a CVSS score of 9.8 or 9.3, which is classified as critical.

Does this vulnerability require authentication to exploit?

No, the source material states that an unauthenticated, network-based attacker can exploit this vulnerability.

Which Junos OS versions are not affected?

Versions 23.2R2-S7.7 and later, 23.4R2-S8.13 and later, 24.2R2-S5.5 and later, and 24.4R2-S5 and later are not affected.