CVE-2026-57025

Junos OS and Junos OS Evolved: EX Series, QFX Series, MX Series: A specific 'show l2-learning/ethernet-switching' command causes l2ald crash

MEDIUM

5.5

CVSS Score

Published: July 9, 2026 at 09:07 PM UTC

Updated: July 16, 2026 at 09:30 AM UTC

43 products affected across 2 vendorsJunosJunos OS EvolvedMx960

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.1%

SSVC

No known exploit

Description

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS). On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted. This issue affects EX Series, QFX Series, MX Series: Junos OS: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S7, * 24.2 versions before 24.2R2, * 24.4 versions before 24.4R1-S2. Junos OS Evolved: * all versions before 23.2R2-S7-EVO, * 23.4 versions before 23.4R2-S8-EVO, * 24.2 versions before 24.2R2-EVO, * 24.4 versions before 24.4R1-S3-EVO.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos OS Evolved · Juniper

95%

Affected range stops below 23.2, so it looks safe — our inference, not a vendor statement

juniper-ex2300 (environment) · juniper-ex2300-c (environment) · juniper-ex3400 (environment) · juniper-ex4000 (environment) · juniper-ex4100 (environment) · juniper-ex4100-f (environment) · juniper-ex4100-h (environment) · juniper-ex4100-h-12t (environment) · juniper-ex4300 (environment) · juniper-ex4400 (environment) · juniper-ex4600 (environment) · juniper-ex4650 (environment) · juniper-ex9204 (environment) · juniper-ex9208 (environment) · juniper-ex9214 (environment) · juniper-mx10004 (environment) · juniper-mx10008 (environment) · juniper-mx2008 (environment) · juniper-mx2010 (environment) · juniper-mx2020 (environment) · juniper-mx204 (environment) · juniper-mx240 (environment) · juniper-mx301 (environment) · juniper-mx304 (environment) · juniper-mx480 (environment) · juniper-mx960 (environment) · juniper-qfx10008 (environment) · juniper-qfx10016 (environment) · juniper-qfx5110 (environment) · juniper-qfx5120 (environment) · juniper-qfx5130 (environment) · juniper-qfx5140 (environment) · juniper-qfx5200 (environment) · juniper-qfx5210 (environment) · juniper-qfx5220 (environment) · juniper-qfx5230-64cd (environment) · juniper-qfx5240 (environment) · juniper-qfx5241 (environment) · juniper-qfx5250 (environment) · juniper-qfx5700 (environment)

Junos · Juniper Networks

95%

v < 23.2v < 23.2R2-S723.4 ≤ v < 23.4R2-S724.2 ≤ v < 24.2R224.4 ≤ v < 24.4R1-S223.2 23.2 r1 23.2 r1-s1 23.2 r1-s2 23.2 r2 23.2 r2-s1 23.2 r2-s2 23.2 r2-s3 23.2 r2-s4 23.2 r2-s5 23.2 r2-s6 23.4 23.4 r1 23.4 r1-s1 23.4 r1-s2 23.4 r2 23.4 r2-s1 23.4 r2-s2 23.4 r2-s3 23.4 r2-s4 23.4 r2-s5 23.4 r2-s6 24.2 24.2 r1 24.2 r1-s1 24.2 r1-s2 24.4 24.4 r1

Affected range stops below 23.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.2R2-S7, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.4R2-S7, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.2R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.4R1-S2, so it looks safe — our inference, not a vendor statement

Junos OS Evolved · Juniper Networks

60%

v < 23.2R2-S7-EVO23.4 ≤ v < 23.4R2-S8-EVO24.2 ≤ v < 24.2R2-EVO24.4 ≤ v < 24.4R1-S3-EVO23.4 24.2 24.4

Affected range stops below 23.2R2-S7-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 23.4R2-S8-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.2R2-EVO, so it looks safe — our inference, not a vendor statement

Affected range stops below 24.4R1-S3-EVO, so it looks safe — our inference, not a vendor statement

Ex2300 · Juniperdevice

80%

All versions

Ex2300-C · Juniperdevice

80%

All versions

Ex3400 · Juniperdevice

80%

All versions

Ex4000 · Juniperdevice

80%

All versions

Ex4100 · Juniperdevice

80%

All versions

Ex4100-F · Juniperdevice

80%

All versions

Ex4100-H · Juniperdevice

80%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://supportportal.juniper.net/JSA110085

References (1)

Vendor Advisory

Source: cverecord

https://supportportal.juniper.net/JSA110085

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMjuniper

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-466

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card