A critical vulnerability in the Juniper Networks Junos OS flow daemon on SRX Series devices allows unauthenticated remote attackers to trigger a persistent denial of service condition.

This vulnerability is an improper check for unusual or exceptional conditions (CWE-754) within the flow daemon (flowd), which can be triggered by an unauthenticated attacker sending specifically crafted, malformed ICMPv6 packets. Successful exploitation forces the srxpfe process to crash and restart, and continuous transmission of these packets results in a sustained denial of service.

The exploitation of this vulnerability results in the interruption of network traffic processing for SRX Series devices performing NAT64 translation. Given the CVSS score of 7.5, the impact is significant for environments relying on these gateways for connectivity, as it can lead to total service unavailability for affected segments. Reputational damage and operational downtime are primary risks for organizations that do not apply the necessary patches.

Immediate Action: Upgrade Junos OS to one of the resolved software releases provided by Juniper Networks, such as 21.2R3-S10, 21.4R3-S12, 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S3, 25.2R1-S2, or 25.2R2.

Proactive Monitoring: Monitor system logs for frequent srxpfe process crashes or unexpected reboots of the flow daemon, which may indicate exploitation attempts.

Compensating Controls: If immediate patching is not feasible, consider implementing firewall filters to drop suspicious or malformed ICMPv6 packets destined for the device interface to mitigate the attack vector.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Organizations utilizing Juniper SRX Series hardware should prioritize this update within their standard maintenance cycle. Because this vulnerability targets a core network process, the risk of service disruption is high for affected deployments. Applying the vendor-supplied patches is the only effective way to neutralize this denial of service risk.