Junos OS rpd: a malformed BGP EVPN update crashes the routing daemon

CVSS 8.7CVE-2025-60004Firmware, BMC & network fabriccurated

Impact

A specific BGP EVPN update message received over an established BGP session crashes and restarts rpd, the routing protocol daemon. Sustained delivery means a repeating crash loop and loss of routing on the device. In a GPU datacenter where Junos boxes are the spine, leaf or border layer, an rpd restart drops BGP adjacencies and reconverges EVPN, which stalls east-west traffic between nodes and can break storage and management reachability at the same time - a multi-node training job loses its collectives and fails rather than degrading. The device does not need any BGP EVPN configuration of its own to be vulnerable; what matters is whether an established peer can send it such an update. Both iBGP and eBGP are affected, over IPv4 and IPv6. Impact is availability only: no data is disclosed or modified.

Who can reach it

Network-based and unauthenticated in the CVSS sense, but it requires an established BGP session with the device - so in practice an attacker who controls or has compromised a BGP peer, or who can inject into the peering path. A device whose peers are not configured to send BGP EVPN updates to it cannot hit this issue.

What to do

Upgrade to a fixed release: Junos OS 23.4R2-S5, 24.2R2-S1, 24.4R1-S3 or 24.4R2, and Junos OS Evolved 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S3-EVO or 24.4R2-EVO. Cost is a fabric maintenance window per device - a Junos upgrade means a reboot of the switch or router, so drain or fail over the affected path first; on a non-redundant leaf that means taking the GPU nodes behind it out of service. Where an upgrade cannot be scheduled yet, verify from the peer side that no neighbor is configured to send EVPN updates to the device, and restrict BGP peering to trusted, authenticated sessions.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-60004 https://supportportal.juniper.net/JSA103165

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.