CVE-2020-1662

Junos OS and Junos OS Evolved: RPD crash due to BGP session flapping.

HIGH

7.5

CVSS Score

Published: October 16, 2020 at 08:31 PM UTC

Updated: June 17, 2026 at 03:02 AM UTC

2 products affected across 1 vendorJunosJunos OS Evolved

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1%

Description

On Juniper Networks Junos OS and Junos OS Evolved devices, BGP session flapping can lead to a routing process daemon (RPD) crash and restart, limiting the attack surface to configured BGP peers. This issue only affects devices with BGP damping in combination with accepted-prefix-limit configuration. When the issue occurs the following messages will appear in the /var/log/messages: rpd[6046]: %DAEMON-4-BGP_PREFIX_THRESH_EXCEEDED: XXXX (External AS x): Configured maximum accepted prefix-limit threshold(1800) exceeded for inet6-unicast nlri: 1984 (instance master) rpd[6046]: %DAEMON-3-BGP_CEASE_PREFIX_LIMIT_EXCEEDED: 2001:x:x:x::2 (External AS x): Shutting down peer due to exceeding configured maximum accepted prefix-limit(2000) for inet6-unicast nlri: 2001 (instance master) rpd[6046]: %DAEMON-4: bgp_rt_maxprefixes_check_common:9284: NOTIFICATION sent to 2001:x:x:x::2 (External AS x): code 6 (Cease) subcode 1 (Maximum Number of Prefixes Reached) AFI: 2 SAFI: 1 prefix limit 2000 kernel: %KERN-5: mastership_relinquish_on_process_exit: RPD crashed on master RE. Sending SIGUSR2 to chassisd (5612:chassisd) to trigger RE switchover This issue affects: Juniper Networks Junos OS: 17.2R3-S3; 17.3 version 17.3R3-S3 and later versions, prior to 17.3R3-S8; 17.4 version 17.4R2-S4, 17.4R3 and later versions, prior to 17.4R2-S10, 17.4R3-S2; 18.1 version 18.1R3-S6 and later versions, prior to 18.1R3-S10; 18.2 version 18.2R3 and later versions, prior to 18.2R3-S4; 18.2X75 version 18.2X75-D50, 18.2X75-D60 and later versions, prior to 18.2X75-D53, 18.2X75-D65; 18.3 version 18.3R2 and later versions, prior to 18.3R2-S4, 18.3R3-S2; 18.4 version 18.4R2 and later versions, prior to 18.4R2-S5, 18.4R3-S2; 19.1 version 19.1R1 and later versions, prior to 19.1R2-S2, 19.1R3-S1; 19.2 version 19.2R1 and later versions, prior to 19.2R1-S5, 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2; 20.1 versions prior to 20.1R1-S2, 20.1R2. Juniper Networks Junos OS Evolved prior to 20.1R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R3-S3.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

17.3R3-S3 ≤ v < 17.3*17.4R2-S4, 17.4R3 ≤ v < 17.4*18.1R3-S6 ≤ v < 18.1*18.2R3 ≤ v < 18.2*18.2X75-D50, 18.2X75-D60 ≤ v < 18.2X75*18.3R2 ≤ v < 18.3*18.4R2 ≤ v < 18.4*19.1R1 ≤ v < 19.1*19.2R1 ≤ v < 19.2*19.3 ≤ v < 19.3R2-S3, 19.3R319.4 ≤ v < 19.4R1-S3, 19.4R220.1 ≤ v < 20.1R1-S2, 20.1R217.2 r3-s3 17.2R3-S3 17.3 r3-s3 17.3 r3-s4 17.3 r3-s7 17.3R3-S3 17.4 r2-s4 17.4 r2-s5 17.4 r2-s6 17.4 r2-s7 17.4 r2-s8 17.4 r2-s9 17.4 r3 17.4 r3-s1 17.4R2-S4 17.4R3 18.1 r3-s6 18.1 r3-s7 18.1 r3-s8 18.1 r3-s9 18.1R3-S6 18.2 r3 18.2 r3-s1 18.2 r3-s2 18.2 r3-s3 18.2R3 18.2X75-D50 18.2X75-D6018.2x75 d5018.2x75 d5118.2x75 d6018.3 r2 18.3 r2-s1 18.3 r2-s2 18.3 r2-s3 18.3 r3 18.3 r3-s1 18.3R2 18.4 r2 18.4 r2-s1 18.4 r2-s2 18.4 r2-s3 18.4 r2-s4 18.4 r3 18.4 r3-s1 18.4R2 19.1 r1 19.1 r1-s1 19.1 r1-s2 19.1 r1-s3 19.1 r1-s4 19.1 r2 19.1 r2-s1 19.1 r3 19.1R1 19.2 r1 19.2 r1-s1 19.2 r1-s2 19.2 r1-s3 19.2R1 19.3 19.3 r1 19.3 r1-s1 19.3 r2 19.3 r2-s1 19.3 r2-s2 19.4 19.4 r1 19.4 r1-s1 19.4 r1-s2 20.1 20.1 r1 20.1 r1-s1

Vendor states this is fixed in 17.2R3-S3 (unaffected)

Affected range stops below 17.3*, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.1*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2X75*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.3*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.3R2-S3, 19.3R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.4R1-S3, 19.4R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.1R1-S2, 20.1R2, so it looks safe — our inference, not a vendor statement

Junos OS Evolved · Juniper Networks

60%

20.1-EVO ≤ v < 20.1R2-EVO19.4-EVO 20.1-EVO

Affected range stops below 20.1R2-EVO, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://kb.juniper.net/JSA11059

References (1)

x_refsource_CONFIRMVendor Advisory

Source: [email protected]

https://kb.juniper.net/JSA11059

CVSS

7.5HIGHjuniper

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-20NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card