Attack Chain

1. Attacker identifies a vulnerable Juniper SRX Series device running Junos OS with NAT64 enabled.
2. The attacker crafts a specific, malformed ICMPv6 packet.
3. The attacker sends the malformed ICMPv6 packet to the SRX device.
4. The SRX device receives the ICMPv6 packet and attempts NAT64 translation.
5. Due to the malformed packet, the flowd process encounters an improper check condition.
6. The srxpfe process crashes as a result of the malformed ICMPv6 packet.
7. The srxpfe process restarts automatically.
8. The attacker continuously sends malformed ICMPv6 packets to repeatedly crash the srxpfe process, sustaining a Denial-of-Service condition.

Impact

Successful exploitation of this vulnerability leads to a Denial-of-Service condition on the affected Juniper SRX Series device. This can disrupt network services, impacting connectivity and availability for legitimate users. The repeated crashing of the srxpfe process can severely degrade device performance and potentially lead to complete service outage. The number of potential victims is dependent on the number of deployed, vulnerable Juniper SRX series devices with NAT64 enabled.

Recommendation

• Apply the appropriate patch or upgrade to a fixed version of Junos OS on SRX Series devices as specified in the Juniper advisory to remediate CVE-2026-33790.
• Monitor network traffic for unusual or malformed ICMPv6 packets destined for SRX devices performing NAT64, as this may indicate exploitation attempts, and deploy the provided Sigma rule to detect such activity.
• Implement rate limiting for ICMPv6 traffic at the network perimeter to mitigate the impact of potential DoS attacks targeting this vulnerability, preventing the continuous crashing of the srxpfe process.