Skip to content
OpenAdvisories
High WID-SEC-2025-0031 7 CVEs

Juniper JUNOS: Mehrere Schwachstellen ermöglichen Denial of Service und Informationsoffenlegung

Published Jan 8, 2025 · Updated Jan 8, 2025 · de-DE

Vendor: Juniper Networks Product: Junos

Summary

Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service Angriff durchzuführen und um vertrauliche Informationen preiszugeben.

Product

JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird.

Vulnerabilities 7

  • High 7.5
    CVE-2025-21598

    Junos OS and Junos OS Evolved: When BGP traceoptions are configured, receipt of malformed BGP packets causes RPD to crash

    An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enab…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • High 7.5
    CVE-2025-21599

    Junos OS Evolved: Receipt of specifically malformed IPv6 packets causes kernel memory exhaustion leading to Denial of Service

    A Missing Release of Memory after Effective Lifetime vulnerability in the Juniper Tunnel Driver (jtd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-based attacker to cause Denial of Service.  Receipt of specifically malformed IPv6 pac…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-21593

    Junos OS and Junos OS Evolved: On SRv6 enabled devices, an attacker sending a malformed BGP update can cause the rpd to crash

    An Improper Control of a Resource Through its Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). On devices with SR…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-21600

    Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash

    An Out-of-Bounds Read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash and restart, re…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-21602

    Junos OS and Junos OS Evolved: Receipt of specially crafted BGP update packet causes RPD crash

    An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and rest…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.5
    CVE-2025-21592

    Junos OS: SRX Series: Low privileged user able to access highly sensitive information on file system

    An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensiti…

    Juniper Networks Junos OS Network devices
  • Medium 5.5
    CVE-2025-21596

    Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crash

    An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem…

    Juniper Networks Junos OS Network devices

Revision history

  1. #1

    Initiale Fassung

References

  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-On-SRv6-enabled-devices-an-attacker-sending-a-malformed-BGP-update-can-cause-the-rpd-to-crash-CVE-2025-21593
  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-specially-crafted-BGP-update-packet-causes-RPD-crash-CVE-2025-21602
  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-traceoptions-are-configured-receipt-of-malformed-BGP-packets-causes-RPD-to-crash-CVE-2025-21598
  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-certain-BGP-options-enabled-receipt-of-specifically-malformed-BGP-update-causes-RPD-crash-CVE-2025-21600
  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-Evolved-Receipt-of-specifically-malformed-IPv6-packets-causes-kernel-memory-exhaustion-leading-to-Denial-of-Service-CVE-2025-21599
  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX1500-SRX4100-SRX4200-Execution-of-low-privileged-CLI-command-results-in-chassisd-crash-CVE-2025-21596
  • Juniper Security Bulletin vom 2025-01-08
    https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-highly-sensitive-information-on-file-system-CVE-2025-21592