Junos OS Evolved fwstatsd: SNMP firewall-counter query crashes the statistics daemon

Impact

A reachable assertion in fwstatsd means an authenticated attacker - or in practice a monitoring system doing a routine SNMP walk - can crash the firewall statistics daemon by querying the firewall-counter MIB, as long as at least one firewall counter is configured. Operators lose the per-filter counters that show whether tenant-isolation ACLs are dropping traffic, which is exactly the data needed to answer whether a noisy neighbour or a misdirected flow is hurting a job. The vector marks the condition continuously repeatable, so an automated poller can keep the daemon in a crash loop without anyone intending an attack. Distinct from the na-grpcd assertion in the same advisory: different daemon, different protocol, and it depends on firewall counters being configured.

Who can reach it

Network: an authenticated SNMP client able to query the firewall-counter MIB on a device with at least one firewall counter configured.

What to do

Upgrade to the Junos OS Evolved release named in JSA112250; expect a reboot per device. Short term, restrict SNMP to the monitoring hosts, and if a poller is triggering the crash, drop the firewall-counter MIB from its collection set until the upgrade lands. Fixed versions are not in this record.

References

Related entries

• Junos rpd: integer overflow in extended-nexthop-tunnel processing crashes the routing daemonCVE-2026-102024 · Juniper Junos OS / Junos OS Evolved rpd (BGP extended-nexthop-tunnel)High
• Junos rpd: mismatched memory management crashes the routing daemon on SRv6 service routes over tunnelled next-hopsCVE-2026-102025 · Juniper Junos OS / Junos OS Evolved rpd (extended next-hop tunneling with SRv6 service processing)High
• Junos rpd: BGP route update crashes the routing daemon when RIB sharding is enabledCVE-2026-102026 · Juniper Junos OS / Junos OS Evolved rpd (RIB sharding)High
• Junos rpd: BGP labeled-unicast updates crash the routing daemon when the affected multipath features are onCVE-2026-102027 · Juniper Junos OS / Junos OS Evolved rpd (BGP labeled-unicast multipath buffer sizing)High
• Junos rpd: multiple BGP UPDATEs on one session crash the routing daemon with l2vpn auto-discovery-onlyCVE-2026-102028 · Juniper Junos OS / Junos OS Evolved rpd (BGP family l2vpn auto-discovery-only)High
• Junos rpd: MSDP or PIM policy using AS-path expansion lets a peer crash the routing daemonCVE-2026-102029 · Juniper Junos OS / Junos OS Evolved rpd (MSDP/PIM policy AS-path expansion)High