This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Juniper Junos OS fixes a medium-severity vulnerability
Juniper Networks fixes a medium-severity vulnerability in Junos OS [1]. Fixed product versions: 21.2R3-S9 (future release), 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4 (future release), 24.2R1-S2, 24.2R2, 24.4R1.
Due to improper isolation/compartmentalization of components in the kernel, an authenticated local attacker with shell access can execute code and compromise the integrity of the machine [1]. In addition to updating to the fixed version, if available, the company strongly recommends restricting shell access to trusted users only. Juniper has confirmed at least one case of active exploitation of this vulnerability. The vulnerability is not exploitable from the Junos CLI.
The vulnerability is present in product:
- *:Junos OS; <21.2R3-S9; >=21.4, <21.4R3-S10; >=22.2, <22.2R3-S6; >=22.4, <22.4R3-S6; >=23.2, <23.2R2-S3; >=23.4, <23.4R2-S4; >=24.2, <24.2R1-S2; >24.2R1-S2, <24.2R2;
CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2025-21590 at cve.org, NVD
- CWE-653: Improper Isolation or Compartmentalization at cwe.mitre.org
The vulnerability was publicly disclosed 12. 3. 2025.
By CESNET, z.s.p.o. Michaela Ručková on 14. 3. 2025.