CVE-2026-57025: Juniper Junos L2ALD Denial-of-Service via Show Commands

Technical summary

CVE-2026-57025 is a return-of-pointer-value-outside-expected-range vulnerability (CWE-466) in the fileio library of Junos OS. When a local user with low privilege executes 'show l2-learning' or 'show ethernet-switching' commands, a pointer validation failure in the l2ald daemon causes it to crash. The l2ald process manages layer-2 address learning and forwarding; its termination suspends all layer-2 services until automatic restart completes (typically seconds to minutes). The CVSS 3.1 score of 5.5 (Medium) reflects local attack vector, low privilege requirement, and availability impact only.

Business impact

Layer-2 services interruption can disrupt network connectivity for bridged segments, VLAN switching, and MAC learning operations. For network operators running EX, QFX, or MX series devices, repeated or malicious invocation of these commands could create operational disruption. In environments with untrusted local access or shared administrative accounts, this becomes a griefing vector. The automatic restart limits sustained impact, but each incident requires troubleshooting and can cascade in layered switching topologies.

Affected systems

Juniper EX Series, QFX Series, and MX Series switches running unpatched Junos OS or Junos OS Evolved are vulnerable. Specific affected versions: Junos OS releases before 23.2R2-S7, 23.4 before 23.4R2-S7, 24.2 before 24.2R2, and 24.4 before 24.4R1-S2; Junos OS Evolved releases before 23.2R2-S7-EVO, 23.4 before 23.4R2-S8-EVO, 24.2 before 24.2R2-EVO, and 24.4 before 24.4R1-S3-EVO. Verify exact platform and release against Juniper's advisory.

Exploitability

Exploitation requires local access and low-level privileges—typically a console session or SSH login as a non-admin user. The attack is trivial to execute: issuing the documented show commands triggers the crash deterministically. No authentication bypass or privilege escalation is needed. However, the requirement for pre-existing local access substantially limits real-world attack surface in most network environments. The vulnerability does not enable lateral movement or data exfiltration.

Remediation

Apply the patched Junos OS or Junos OS Evolved versions specified in the advisory: 23.2R2-S7+, 23.4R2-S7+, 24.2R2+, and 24.4R1-S2+ for standard Junos; corresponding -EVO versions for Evolved. Patches address the pointer validation flaw in the fileio library. Testing upgrades in a lab or staging environment is recommended given the layer-2 service criticality. Scheduled maintenance windows should account for potential brief l2ald restarts during the first few commands post-upgrade.

Patch guidance

Juniper has released patches across all four major release trains (23.2, 23.4, 24.2, 24.4) for both Junos OS and Junos OS Evolved. Verify your current version against 'show version' output and cross-reference the advisory for the correct target release. Upgrades typically require a reboot; plan accordingly. If you are on an older maintenance release (e.g., 23.2R1), you may need to upgrade to 23.2R2 first, then apply the security patch. For large deployments, stagger upgrades to maintain availability.

Detection guidance

Monitor for repeated l2ald process crashes and restarts in system logs (look for 'l2ald' entries in syslog or the UI Alarms view). If available, enable debug logging for fileio or layer-2 diagnostics before the crash occurs to capture the exact command sequence. Correlate process restarts with 'show l2-learning' or 'show ethernet-switching' command invocations from user sessions. A pattern of crashes following these commands from the same user account may indicate intentional exploitation.

Why prioritize this

Medium severity with limited exploitability makes this lower priority than remote code-execution vulnerabilities, but it merits near-term patching if you operate the affected platforms. The automatic restart limits production impact, yet operational downtime from repeated incidents could compound in production networks. Prioritize based on: (1) whether your devices are in the vulnerable range, (2) whether untrusted users can access the CLI, and (3) your tolerance for brief layer-2 outages. If you have strong access controls restricting show commands to trusted admins, risk is reduced.

Risk score, explained

The CVSS 3.1 base score of 5.5 reflects: Attack Vector = Local (requires user presence), Attack Complexity = Low (trivial trigger), Privileges Required = Low (non-admin account suffices), User Interaction = None (no clicks/prompts), Scope = Unchanged, Confidentiality = None, Integrity = None, and Availability = High (service crash). This is a textbook local DoS with no confidentiality or integrity breach. The score appropriately weights the impact (temporary outage) against the constraint (local access only).

Frequently asked questions