Skip to content
OpenAdvisories
High WID-SEC-2025-1519 26 CVEs

Juniper JUNOS: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Published Jul 9, 2025 · Updated Oct 9, 2025 · Revision 4 · de-DE

Vendor: Juniper Networks Product: Junos Product: Junos Space Product: MX Series Product: Security Director Product: SRX Series

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Juniper JUNOS, Juniper MX Series, Juniper SRX Series und Juniper Security Director ausnutzen, um Daten zu manipulieren oder offenzulegen, Sicherheitsmaßnahmen zu umgehen, Code auszuführen, einen Denial of Service zu verursachen oder seine Privilegien zu erweitern.

Product

JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird.
Die Juniper MX-Serie ist eine Produktfamilie von Routern.
SRX Series Services Gateways ist ein Next-Generation Anti-Threat Firewall von Juniper.
Juniper Security Director ermöglicht die Verwaltung und Kontrolle von Sicherheitsrichtlinien für lokale Infrastrukturen über eine zentrale, webbasierte Benutzeroberfläche.

Vulnerabilities 26

  • Critical 9.6
    CVE-2025-52950

    Juniper Security Director: Insufficient authorization for multiple endpoints in web interface

    A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple sensitive resources via the web interface. Numerous endpoints on the Juniper Security Director applian…

    Juniper Networks Juniper Security Director Network devices
  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine
  • High 7.8
    CVE-2025-52954

    Junos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromising the system

    A Missing Authorization vulnerability in the internal virtual routing and forwarding (VRF) of Juniper Networks Junos OS Evolved allows a local, low-privileged user to gain root privileges, leading to a system compromise. Any low-privileged user with the capab…

    Juniper Networks Junos OS Evolved Network devices
  • High 7.5
    CVE-2025-52946

    Junos OS and Junos OS Evolved: With traceoptions enabled, receipt of malformed AS PATH causes RPD crash

    A Use After Free vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an attacker sending a BGP update with a specifically malformed AS PATH to cause rpd to crash, resulting in a Denial o…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • High 7.5
    CVE-2025-52980

    Junos OS: SRX300 Series: rpd will crash upon receiving a specific, valid BGP UPDATE message

    A Use of Incorrect Byte Ordering vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a BGP update is received over an estab…

    Juniper Networks Junos OS Network devices
  • High 7.5
    CVE-2025-52981

    Junos OS: SRX Series: Sequence of specific PIM packets causes a flowd crash

    An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX1600, SRX2300, SRX 4000 Series, and SRX5000 Series with SPC3 allows an unauthenticated, network-based attacker to ca…

    Juniper Networks Junos OS Network devices
  • High 7.3
    CVE-2025-30661

    Junos OS: Low-privileged user can cause script to run as root, leading to privilege escalation

    An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileged user to install scripts to be executed as root, leading to privilege escalation. A local user wit…

    Juniper Networks Junos OS Network devices
  • High 7.2
    CVE-2025-52983

    Junos OS: After removing ssh public key authentication root can still log in

    A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root ha…

    Juniper Networks Junos OS Network devices
  • Medium 6.7
    CVE-2025-52988

    Junos OS and Junos OS Evolved: Privilege escalation to root via CLI command 'request system logout'

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a high privileged, local attacker to escalated their privileges to root. When a use…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-52947

    Junos OS: ACX Series: When 'hot-standby' mode is configured for an L2 circuit, interface flap causes the FEB to crash

    An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platforms allows an attacker to crash the Forwarding Engine Board (FEB) by flapping an interface, leading to…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2025-52949

    Junos OS and Junos OS Evolved: In an EVPN environment, receipt of specifically malformed BGP update causes RPD crash

    An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a logically adjacent BGP peer sending a specifically malformed BGP packet to cause rpd to crash …

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-52952

    Junos OS: MX Series with MPC-BUILTIN, MPC 1 through MPC 9: Receipt and processing of a malformed packet causes one or more FPCs to crash

    An Out-of-bounds Write vulnerability in the connectivity fault management (CFM) daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the devic…

    Juniper Networks Junos OS Network devices
  • Medium 6.5
    CVE-2025-52953

    Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session reset

    An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a valid BGP UPDATE packet to cause a BGP session reset, resulting in a Deni…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-52955

    Junos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restart

    An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a memory corruption that leads to a rpd crash.  When the logical …

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-52964

    Junos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configured

    A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When the device receives a specific BGP UPDATE pac…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 6.5
    CVE-2025-6549

    Junos OS: SRX Series: J-Web can be exposed on additional interfaces

    An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the Juniper Web Device Manager (J-Web). When Juniper Secure connect (JSC) is enabled on specific i…

    Juniper Networks Junos OS Network devices
  • Medium 5.9
    CVE-2025-26466 Public exploit EPSS 39%

    Openssh: denial-of-service in openssh

    A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may k…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2025-52948

    Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled

    An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart…

    Juniper Networks Junos OS Network devices
  • Medium 5.9
    CVE-2025-52982

    Junos OS: MX Series: When specific SIP packets are processed the MS-MPC will crash

    An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an MX Series device with an MS-MPC is config…

    Juniper Networks Junos OS Network devices
  • Medium 5.9
    CVE-2025-52984

    Junos OS and Junos OS Evolved: When a static route points to a reject next-hop and a gNMI query for this route is processed, RPD crashes

    A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause impact to the availability of the device. When static route points to a …

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.8
    CVE-2025-52951

    Junos OS: IPv6 firewall filter fails to match payload-protocol

    A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface. Due to an issue with…

    Juniper Networks Junos OS Network devices
  • Medium 5.5
    CVE-2025-52963

    Junos OS: A low-privileged user can disable an interface

    An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an interface, leading to a Denial-of-Service. Users with "view" permissions can run a specific request inter…

    Juniper Networks Junos OS Network devices
  • Medium 5.5
    CVE-2025-52986

    Junos OS and Junos OS Evolved: When RIB sharding is configured each time a show command is executed RPD memory leaks

    A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device. When RIB shardi…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.3
    CVE-2025-52958

    Junos OS and Junos OS Evolved: When route validation is enabled, BGP connection establishment failure causes RPD crash

    A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved devices, when route…

    Juniper Networks Junos OS Junos OS Evolved Network devices
  • Medium 5.3
    CVE-2025-52985

    Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matching

    A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a firewall filter which is applied to the lo0 or re:mgmt inte…

    Juniper Networks Junos OS Evolved Network devices
  • Medium 5.1
    CVE-2025-52989

    Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration

    An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration. A user with limited configuration and commit per…

    Juniper Networks Junos OS Junos OS Evolved Network devices

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2025-33364, EUVD-2025-33365

  2. #3

    Neue Updates von Juniper aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2025-21162, EUVD-2025-21161, EUVD-2025-21160, EUVD-2025-21158, EUVD-2025-21157, EUVD-2025-21165, EUVD-2025-21167, EUVD-2025-21156, EUVD-2025-21155, EUVD-2025-21166, EUVD-2025-21163

  4. #1

    Initiale Fassung

References