CVE-2016-1270
HighSummary
The rpd daemon in Juniper Junos OS before versions 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R6, 14.1 before 14.1R4, and 14.2 before 14.2R2, when configured with BGP-based L2VPN or VPLS, allows remote attackers to cause a denial of service (daemon restart) via a crafted L2VPN family BGP update.
Risk Assessment
Attackers can remotely trigger a daemon failure, leading to service unavailability, which may impact the continuity of organizational operations.
Recommendation
It is recommended to update the Junos OS to the latest version to mitigate this vulnerability and to monitor BGP traffic for potential attacks.
Related vulnerabilities
- CVE-2026-125757Critical
mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering.
- CVE-2026-121683Critical
Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core certificate entries.
- CVE-2026-121653Critical
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- CVE-2026-108186Critical
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- CVE-2026-124917Critical
Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- CVE-2026-124903Critical
A sandbox escape due to a use-after-free exists in the IPC component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124900Critical
A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.
- CVE-2026-124864Critical
Use-after-free vulnerability in the DOM: Service Workers component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124861Critical
Use-after-free vulnerability in the Audio/Video: cubeb component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
- CVE-2026-124859Critical
Sandbox escape in the Storage: Cache API component of Firefox caused by incorrect boundary conditions. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Original NVD description (English source)
The rpd daemon in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R6, 14.1 before 14.1R4, and 14.2 before 14.2R2, when configured with BGP-based L2VPN or VPLS, allows remote attackers to cause a denial of service (daemon restart) via a crafted L2VPN family BGP update.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS