Skip to content
OpenAdvisories
High NCSC-2025-0305 15 CVEs

Kwetsbaarheden verholpen in Juniper Networks Junos OS

Published Oct 13, 2025 · Updated Oct 13, 2025 · nl

Vendor: Juniper Networks Product: Junos OS Product: Junos OS Evolved Product: Junos Space Product: Junos Space Security Director Product: Security Director Product: Security Director Policy Enforcer Product: SRX Series Product: vSRX Series

Summary

Juniper heeft kwetsbaarheden verholpen in Junos OS (Specifiek voor EX4600, QFX5000 Series switches en SRX4700 apparaten).

Details

Interpretaties
De kwetsbaarheden in Junos OS omvatten verschillende ernstige problemen, waaronder de mogelijkheid voor ongeauthenticeerde aanvallers om Denial of Service (DoS) te veroorzaken door het versturen van speciaal vervaardigde pakketten, het manipuleren van URL-parameters, en het omzeilen van authenticatieprocessen. Dit kan leiden tot systeemcrashes, ongeautoriseerde toegang tot gevoelige gegevens, en verstoring van netwerkdiensten. De impact van deze kwetsbaarheden kan aanzienlijk zijn, vooral voor organisaties die afhankelijk zijn van Junos OS voor hun netwerkbeheer.

Oplossingen
Juniper heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 15

  • High 8.6
    CVE-2025-59968

    Junos Space Security Director: Insufficient authorization for sensitive resources in web interface

    A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.  Tampering with this metadata can result in managed SRX Series devic…

    Juniper Networks Junos OS Junos Space Security Director Network devices
  • High 7.5
    CVE-2025-59964

    Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restart

    A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When forwarding-options sampling is enabl…

    Juniper Networks Junos OS Network devices
  • High 7.5
    CVE-2025-59975

    Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management access DoS

    An Uncontrolled Resource Consumption vulnerability in the HTTP daemon (httpd) of Juniper Networks Junos Space allows an unauthenticated network-based attacker flooding the device with inbound API calls to consume all resources on the system, leading to a Deni…

    Juniper Networks Junos Space Network devices
  • High 7.5
    CVE-2025-60004

    Junos OS and Junos OS Evolved: Specific BGP EVPN update message causes rpd crash

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-Of-Service (DoS). When an affected…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • High 7.4
    CVE-2025-11198

    Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server

    A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment,…

    Juniper Networks Security Director Policy Enforcer Network devices
  • Medium 6.8
    CVE-2025-59957

    Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

    An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete contro…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2025-52961

    Junos OS Evolved: PTX Series except PTX10003: An unauthenticated adjacent attacker sending specific valid traffic can cause a memory leak in cfmman leading to FPC crash and restart

    An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, PTX10016 all…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-59958

    Junos OS Evolved: PTX Series: When a firewall filter rejects traffic these packets are erroneously sent to the RE

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availabilit…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-59967

    Junos OS Evolved: ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: When specific valid multicast traffic is received on the L3 interface on a vulnerable device evo-pfemand crashes and restarts

    A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause a Denial-of…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-59976

    Junos Space: Arbitrary file download vulnerability in web interface

    An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can …

    Juniper Networks Junos Space Network devices
  • Medium 6.5
    CVE-2025-59980

    Junos OS: When a user with the name ftp or anonymous is configured unauthenticated filesystem access is allowed

    An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "an…

    Juniper Networks Junos OS Network devices
  • Medium 5.9
    CVE-2025-52960

    Junos OS: SRX Series and MX Series: Receipt of specific SIP packets in a high utilization situation causes a flowd/mspmand crash

    A Buffer Copy without Checking Size of Input vulnerability in the Session Initialization Protocol (SIP) ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When mem…

    Juniper Networks Junos OS Network devices
  • Medium 5.4
    CVE-2025-60010

    Junos OS and Junos OS Evolved: Device allows login for user with expired password

    A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. Affected devices allow logins by users f…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.3
    CVE-2025-59962

    Junos OS and Junos OS Evolved: With BGP sharding enabled, change in indirect next-hop can cause RPD crash

    An Access of Uninitialized Pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding configured allows an attacker triggering indirect next-hop updates, along with timing outside the attacke…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.3
    CVE-2025-60006

    Junos OS Evolved: OS command injection vulnerabilities fixed

    Multiple instances of an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and/or execute unauthorized commands. When an…

    Juniper Networks Junos OS Evolved Network devices

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Juniper-Security-Director-Insufficient-authorization-for-sensitive-resources-in-web-interface-CVE-2025-59968
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Device-allows-login-for-user-with-expired-password-CVE-2025-60010
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Specific-BGP-EVPN-update-message-causes-rpd-crash-CVE-2025-60004
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-sharding-enabled-change-in-indirect-next-hop-can-cause-RPD-crash-CVE-2025-59962
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-ACX7024-ACX7024X-ACX7100-32C-ACX7100-48L-ACX7348-ACX7509-When-specific-valid-multicast-traffic-is-received-on-the-L3-interface-a-vulnerable-device-evo-pfemand-crashes-and-restarts-CVE-2025-59967
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-Multiple-OS-command-injection-vulnerabilities-fixed-CVE-2025-60006
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-except-PTX10003-An-unauthenticated-adjacent-attacker-sending-specific-valid-traffic-can-cause-a-memory-leak-in-cfmman-leading-to-FPC-crash-and-restart-CVE-2025-52961
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-When-firewall-filter-rejects-traffic-these-packets-are-erroneously-sent-to-the-RE-CVE-2025-59958
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-EX4600-Series-and-QFX5000-Series-An-attacker-with-physical-access-can-open-a-persistent-backdoor-CVE-2025-59957
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX-Series-and-MX-Series-Receipt-of-specific-SIP-packets-in-a-high-utilization-situation-causes-a-flowd-crash-CVE-2025-52960
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX4700-When-forwarding-options-sampling-is-enabled-any-traffic-destined-to-the-RE-will-cause-the-forwarding-line-card-to-crash-and-restart-CVE-2025-59964
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-When-a-user-with-the-name-ftp-or-anonymous-is-configured-unauthenticated-filesystem-access-is-allowed-CVE-2025-59980
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Arbitrary-file-download-vulnerability-in-web-interface-CVE-2025-59976
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Flooding-device-with-inbound-API-calls-leads-to-WebUI-and-CLI-management-access-DoS-CVE-2025-59975
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Reflected-client-side-HTTP-parameter-pollution-vulnerability-in-web-interface-CVE-2025-59977
  • Reference
    https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Security-Director-Policy-Enforcer-An-unrestricted-API-allows-a-network-based-unauthenticated-attacker-to-deploy-malicious-vSRX-images-to-VMWare-NSX-Server-CVE-2025-11198