CVE-2026-21913
Description
An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
On EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) a high volume of traffic destined to the device will cause an FXPC crash and restart, which leads to a complete service outage until the device has automatically restarted.
The following reboot reason can be seen in the output of 'show chassis routing-engine' and as a log message:
reason=0x4000002 reason_string=0x4000002:watchdog + panic with core dump
This issue affects Junos OS on EX4000-48T, EX4000-48P and EX4000-48MP:
- 24.4 versions before 24.4R2,
- 25.2 versions before 25.2R1-S2, 25.2R2.
This issue does not affect versions before 24.4R1 as the first Junos OS version for the EX4000 models was 24.4R1.
Affected products
11cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*+ 9 more
- cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:*
- (no CPE)range: 24.4 versions before 24.4R2, 25.2 versions before 25.2R1-S2, 25.2R2
- (no CPE)range: 24.4
- Range: 24.4 versions before 24.4R2, 25.2 versions before 25.2R1-S2, 25.2R2
Patches
Vulnerability mechanics
References
2- kb.juniper.net/JSA106014nvdVendor Advisory
- supportportal.juniper.net/JSA106014nvdVendor Advisory
News mentions
0No linked articles in our index yet.