This vulnerability involves the use of multiple resources with duplicate identifiers in the iked process of Juniper Junos OS on MX with SPC3 and SRX Series devices. Failed VPN negotiations cause a peer index rollover, assigning duplicate index values to new peers. This causes the iked daemon to crash repeatedly, leading to denial of service by disrupting VPN connection establishment and rekeying. The affected versions include all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S4, and 25.2 versions before 25.2R1-S1. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and impacts availability only. The vendor has released patches for these versions. The iked process must be running for exposure; kmd process is not affected. Monitoring tunnel up/down events can help detect potential exploitation since the index value is not directly observable.

An unauthenticated, network-based attacker can cause a denial-of-service condition by triggering repeated crashes of the iked daemon. This prevents new VPN connections from being established and disrupts rekeying of existing VPN tunnels, impacting availability of VPN services on affected devices. Recovery requires a system reboot, causing service interruption.

A patch is available from Juniper Networks for the affected Junos OS versions. Users should upgrade to the fixed releases: 23.2R2-S7 or later for 23.2 versions, 23.4R2-S6 or later for 23.4 versions, 24.2R2-S3 or later for 24.2 versions, 24.4R2-S4 or later for 24.4 versions, and 25.2R1-S1 or later for 25.2 versions. Monitoring tunnel up/down events can help identify if the issue is occurring, as the peer index value is not directly monitorable. No other specific mitigations are indicated. Since this is a cloud-managed service, the vendor typically manages remediation for cloud-hosted instances; check vendor advisories for confirmation.