LiveActive security incident?Get immediate response
CVE Record

CVE-2022-22213: Junos OS and Junos OS Evolved: Denial of Service (DoS) vulnerability in RPD upon receipt of specific BGP update

A vulnerability in Handling of Undefined Values in the routing protocol daemon (RPD) process of Juniper Networks Junos OS and Junos OS Evolved may allow an unauthenticated network-based attacker to crash the RPD process by sending a specific BGP update while the system is under heavy load, leading to a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Malicious exploitation of this issue requires a very specific combination of load, timing, and configuration of the vulnerable system which is beyond the direct control of the attacker. Internal reproduction has only been possible through artificially created load and specially instrumented source code. Systems are only vulnerable to this issue if BGP multipath is enabled. Routers not configured for BGP multipath are not vulnerable to this issue. This issue affects: Juniper Networks Junos OS: 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2. Juniper Networks Junos OS Evolved: 21.1 versions prior to 21.1R3-S1-EVO; 21.2 version 21.2R1-EVO and later versions; 21.3 versions prior to 21.3R3-EVO; 21.4 versions prior to 21.4R1-S1-EVO, 21.4R2-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 21.1. Juniper Networks Junos OS Evolved versions prior to 21.1-EVO.

MediumCVSS 5.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

A Juniper routing software flaw can crash the routing daemon when a vulnerable router processes a specific BGP update under heavy load. The business impact is network routing disruption, not data theft. Exposure is limited to Junos OS and Junos OS Evolved 21.1-21.4 systems with BGP multipath enabled and below fixed releases.

Executive priority

Treat as a moderate availability risk for routing infrastructure. It is not a broad compromise issue, but affected edge or backbone routers could suffer service disruption. Prioritize validation on BGP multipath deployments and patch during normal network maintenance windows unless business-critical routing exposure is confirmed.

Technical view

CVE-2022-22213 is CWE-232 in RPD. An unauthenticated network attacker can trigger an RPD crash using a specific BGP update while the device is heavily loaded. Sustained receipt can maintain DoS. Attack complexity is high, with no confidentiality or integrity impact and high availability impact.

Likely exposure

Likely exposure is routers running affected Junos OS or Junos OS Evolved 21.1-21.4 releases with BGP multipath enabled. Routers without BGP multipath are not vulnerable. Junos OS before 21.1 and Junos OS Evolved before 21.1-EVO are listed as unaffected.

Exploitation context

No source in the bundle reports active exploitation, and KEV status is false. Juniper states exploitation needs a very specific combination of load, timing, and configuration beyond direct attacker control, with internal reproduction only under artificial load and specially instrumented source code.

Researcher notes

The key exposure gate is BGP multipath. The advisory describes a narrow race-like operational condition involving load, timing, and configuration. Avoid assuming exploitability on all BGP routers. Evidence does not support credential theft, code execution, or active exploitation claims.

Mitigation direction

  • Upgrade Junos OS to the fixed release for the installed 21.1, 21.2, 21.3, or 21.4 train.
  • Upgrade Junos OS Evolved to the fixed EVO release for the installed affected train.
  • Where operationally acceptable, disable BGP multipath on vulnerable routers.
  • Check Juniper JSA69717 for current vendor guidance before scheduling remediation.

Validation and detection

  • Inventory Juniper routers running Junos OS or Junos OS Evolved 21.1 through 21.4.
  • Confirm whether BGP multipath is enabled on each potentially affected router.
  • Compare installed versions against the fixed versions listed in Juniper JSA69717.
  • Review routing daemon crash logs for unexplained RPD restarts during heavy load.
  • Prioritize internet-facing or externally peered BGP routers for verification.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-232: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-22213 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.9CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.9Medium
CVSS 3.1 vector shape for CVE-2022-22213Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Juniper NetworksJunos OSunspecified, 21.1, 21.2, 21.3, 21.4Listed
Juniper NetworksJunos OS Evolvedunspecified, 21.1, 21.2R1-EVO, 21.3, 21.4Listed
Weakness

CWE details

CWE-232

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-232 · source CWE mapping

Improper Handling of Undefined Values

Improper Handling of Undefined Values represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs