Description

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:18:28.320Z",
  "pubdate": "2026-10-14T17:18:28.320Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved.\nThis vulnerability is triggered through the processing of BMP (BGP Monitoring Protocol) route monitoring packets received from a configured external BGP neighbor.\nSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary commands on the target device with full root privileges.\nThe flaw stems from improper memory management during the parsing of malformed or maliciously crafted BMP messages within the rpd process.\nAs the rpd process operates with high-level system permissions, compromising this component grants the attacker complete control over the routing engine, potentially allowing for the subversion of routing tables, interception of traffic, and full system takeover.\nGiven the severity and the potential for remote execution without prior authentication, this vulnerability poses an extreme risk to network infrastructure integrity and availability.\nExploitation is contingent upon the presence of an established BGP peering session configured for BMP monitoring, which represents a common deployment scenario in service provider environments.",
  "technicalDetails": "The vulnerability resides in the routing protocol daemon (rpd), which serves as the core user-space process responsible for managing routing protocols and forwarding information base (FIB) updates in Junos OS and Junos OS Evolved.\nThe root cause is a stack-based buffer overflow occurring during the decoding and deserialization of BMP route monitoring data. When the rpd process parses incoming BMP messages from an external BGP neighbor, it fails to perform adequate bounds checking on the input length before copying the data into fixed-size stack buffers.\nThe attack flow begins when an attacker, acting as a configured BGP neighbor, sends a specially crafted BMP message to the device. By providing a payload that exceeds the capacity of the destination buffer on the stack, the attacker can overwrite adjacent stack memory, including critical data structures and, crucially, the instruction pointer or return address.\nBy precisely controlling the content of the buffer, an attacker can redirect the execution flow of the rpd process to attacker-supplied shellcode or execute return-oriented programming (ROP) chains. Because rpd executes with root privileges to interact with the kernel's routing tables and hardware forwarding plane, any code executed through this overflow inherently runs with root-level access.\nThe exploitation process does not require prior authentication beyond being an established or configured BGP neighbor capable of sending BMP traffic. Once the control flow is hijacked, the attacker can install persistent backdoors, modify system configurations, or bypass security enforcement mechanisms entirely.\nThe vulnerable component is specifically the BMP message parsing logic within rpd. Due to the nature of stack overflows, the payload may need to be tailored to the specific binary layout and stack canary protections of the target Junos OS version. Post-exploitation impact includes complete system compromise, where the attacker can intercept sensitive network traffic, perform reconnaissance from the perspective of the core router, or cause a denial-of-service by crashing the rpd process, leading to a catastrophic failure of the routing engine."
}