Database/Firmware, BMC & network fabric
Junos OS: reachable assertion in the TWAMP client lets one TCP packet kill rmopd
Impact
A specific TCP packet to a Junos device running the TWAMP client trips an assertion and takes down rmopd, the daemon behind remote operations and performance measurement. The forwarding plane survives, but the device loses the active measurement that operators use to see latency and loss across the fabric - exactly the telemetry a GPU cluster relies on to notice a sick link before a training job stalls. Repeated packets keep the daemon down. No authentication is needed.
Who can reach it
Network, unauthenticated. Any host that can open a TCP connection to the TWAMP client on the device; in practice whoever can reach the measurement endpoints, which on many fabrics is the management VLAN or a peering segment.
What to do
Upgrade to a fixed Junos release per Juniper advisory JSA112188 - the record does not list fixed versions, so check the advisory against your train. The upgrade is a device reboot. As an interim measure, disable the TWAMP client where it is not in use and filter TWAMP reachability to the measurement collectors.
References
Related entries
- Junos OS on SRX: malformed ADVPN peer attributes overflow the VPN daemon and take over the deviceCVE-2026-102084 · Juniper Junos OS VPN daemon on SRX Series (ADVPN peer message validation)Critical
- Junos rpd: BGP updates processed by BMP route monitoring overflow a stack buffer, up to root executionCVE-2026-33789 · Juniper Junos OS / Junos OS Evolved rpd (BGP Monitoring Protocol route export)Critical
- Linux kernel bnxt_re: doorbell page allocation reports success when ioremap fails, leaving unwound driver stateCVE-2026-72496 · Linux kernel bnxt_re RoCE driver (bnxt_qplib_alloc_dpi doorbell ioremap error path)Critical
- Arista EOS gNPSI: unauthenticated request yields arbitrary code execution on the switchCVE-2026-73456 · Arista EOS (gNPSI - gRPC Network Packet Sampling Interface)Critical
- Arista EOS: crafted packet brings down authenticated BFD sessions and triggers routing changesCVE-2026-73458 · Arista EOS BFD (authenticated session packet handling)Critical
- MikroTik RouterOS: SSH username argument handling lets an unauthenticated client escalate policy privilegesCVE-2026-86060 · MikroTik RouterOS (SSH login helper, policy mask handling)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.