This vulnerability (CWE-466) involves a return of a pointer value outside the expected range in the fileio library of Junos OS and Junos OS Evolved. On affected EX, QFX, and MX Series devices, a low-privileged local attacker can issue crafted 'show l2-learning' or 'show ethernet-switching' commands that cause the l2ald process to crash, leading to a denial-of-service impacting layer 2 services until automatic recovery. The vulnerability affects all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2, and 24.4 versions before 24.4R1-S2 on Junos OS, and similarly versioned releases on Junos OS Evolved. The CVSS 3.1 score is 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, and impact limited to availability.

Successful exploitation causes a denial-of-service by crashing the l2ald process on EX, QFX, and MX Series devices running affected Junos OS or Junos OS Evolved versions. This results in temporary disruption of all layer 2 services until the process automatically restarts. There is no impact on confidentiality or integrity.

A patch is available for this vulnerability. Users should upgrade to fixed versions: for Junos OS, 23.2R2-S7 or later, 23.4R2-S7 or later, 24.2R2 or later, and 24.4R1-S2 or later; for Junos OS Evolved, 23.2R2-S7-EVO or later, 23.4R2-S8-EVO or later, 24.2R2-EVO or later, and 24.4R1-S3-EVO or later. Since this is a cloud service environment, Juniper manages remediation for cloud-hosted services; check the vendor advisory for confirmation and update schedules. Until patched, restrict local access to trusted users to mitigate risk.