This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Juniper Junos OS and Junos OS Evolved fix several vulnerabilities

Juniper fixes several vulnerabilities in Junos OS and Junos OS Evolved, which concern multiple devices and affect various versions. Details of the vulnerabilities and their fixes can be found at [1]. The most severe of them are described below.

Juniper Junos OS and Junos OS Evolved - DoS (CVE-2025-52946)
CVSS 7.5 (High)

An unauthenticated remote attacker is, due to a Use After Free error in the routing protocol daemon (RPD) in Juniper Networks Junos OS and Junos OS Evolved, allowed to carry out a DoS attack by sending a specially crafted BGP update with a malformed AS PATH. Systems without BGP traceoptions enabled are not affected [2].

The vulnerability is present in products:

  • Junos OS; <21.2R3-S9; =21.4; >=22.2, <22.2R3-S6; >=22.4, <22.4R3-S5; >=23.2, <23.2R2-S3; >=23.4, <23.4R2-S4; >=24.2, <24.2R2
  • Junos OS Evolved; <22.4R3-S5-EVO; >=23.2-EVO, <23.2R2-S3-EVO; >=23.4-EVO, <23.4R2-S4-EVO; >=24.2-EVO, <24.2R2-EVO

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

Juniper Junos OS - DoS (CVE-2025-52980)
CVSS 7.5 (High)

An unauthenticated remote attacker is, due to incorrect interpretation of byte order in the routing protocol daemon (RPD) in Juniper Networks Junos OS on SRX300 series devices, allowed to carry out a DoS attack by sending a BGP update with a valid optional transitive attribute. The vulnerability affects eBGP and iBGP connections over both IPv4 and IPv6 [3].

The vulnerability is present in product:

  • Junos OS; >=22.1R1, <22.2R3-S4; >=22.3, <22.3R3-S3, >=22.4, <22.4R3-S2; >=23.2, <23.2R2; >=23.4, <23.4R2.

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

Juniper Junos OS Evolved - privilege escalation (CVE-2025-52954)
CVSS 7.8 (High)

An authenticated local attacker is, due to missing authorization in the internal virtual routing and forwarding (VRF) in Juniper Networks Junos OS Evolved, allowed to obtain root privileges, execute arbitrary commands and modify its configuration, and thereby may fully compromise the entire system [4].

The vulnerability is present in product:

  • Junos OS Evolved; <22.2R3-S7-EVO; >=22.4, <22.4R3-S7-EVO; >=23.2, <23.2R2-S4-EVO; >=23.4, <23.4R2-S5-EVO; >=24.2, <24.2R2-S1-EVO; >=24.4, <24.4R1-S2-EVO; =24.4R2-EVO

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

Juniper Junos OS - DoS (CVE-2025-52981)
CVSS 7.5 (High)

An unauthenticated remote attacker is, due to improper checking of conditions in the flow processing daemon (flowd) in Juniper Networks Junos OS on SRX1600, SRX2300, SRX 4000 series and SRX5000 devices with SPC3, allowed to carry out a DoS attack by sending a sequence of specific PIM packets [5].

The vulnerability is present in product:

  • Junos OS; <21.2R3-S9; >=21.4,<21.4R3-S11; >=22.2, <22.2R3-S7; >=22.4, <22.4R3-S6; >=23.2, <23.2R2-S4; >=23.4, <23.4R2-S4; >=24.2, <24.2R2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 9. 7. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 17. 7. 2025.

CESNET, z.s.p.o. Logo