rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-52952 Junos OS: MX Series with MPC-BUILTIN, MPC 1 through MPC 9: Receipt and processing of a malformed packet causes one or more FPCs to crash
An Out-of-bounds Write vulnerability in the connectivity fault management (CFM) daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS).

Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects Juniper Networks:
Junos OS:
  *  All versions before 22.2R3-S1,
  *  from 22.4 before 22.4R2.


This feature is not enabled by default.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:04:35.691Z
CVE-2025-52953 Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session reset
An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a valid BGP UPDATE packet to cause a BGP session reset, resulting in a Denial of Service (DoS). 

Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.

This issue affects iBGP and eBGP and both IPv4 and IPv6 are affected by this vulnerability.

This issue affects Junos OS:


  *  All versions before 21.2R3-S9,
  *  from 21.4 before 21.4R3-S11,
  *  from 22.2 before 22.2R3-S7,
  *  from 22.4 before 22.4R3-S7,
  *  from 23.2 before 23.2R2-S4,
  *  from 23.4 before 23.4R2-S4,
  *  from 24.2 before 24.2R2,
  *  from 24.4 before 24.4R1-S3, 24.4R2


Junos OS Evolved:



  *  All versions before 22.2R3-S7-EVO,
  *  from 22.4-EVO before 22.4R3-S7-EVO,
  *  from 23.2-EVO before 23.2R2-S4-EVO,
  *  from 23.4-EVO before 23.4R2-S4-EVO,
  *  from 24.2-EVO before 24.2R2-EVO,
  *  from 24.4-EVO before 24.4R1-S3-EVO, 24.4R2-EVO.
Problem types: cwe_id: CWE-440
description: CWE-440 Expected Behavior Violation
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:04:55.140Z
CVE-2025-52954 Junos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromising the system
A Missing Authorization vulnerability in the internal virtual routing and forwarding (VRF) of Juniper Networks Junos OS Evolved allows a local, low-privileged user to gain root privileges, leading to a system compromise.

Any low-privileged user with the capability to send packets over the internal VRF can execute arbitrary Junos commands and modify the configuration, and thus compromise the system. 

This issue affects Junos OS Evolved: 



  *  All versions before 22.2R3-S7-EVO, 
  *  from 22.4 before 22.4R3-S7-EVO, 
  *  from 23.2 before 23.2R2-S4-EVO, 
  *  from 23.4 before 23.4R2-S5-EVO, 
  *  from 24.2 before 24.2R2-S1-EVO
  *  from 24.4 before 24.4R1-S2-EVO, 24.4R2-EVO.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-11T14:42:02.013Z
CVE-2025-52955 Junos OS and Junos OS Evolved: When jflow/sflow is configured continuous logical interface flaps causes rpd crash and restart
An Incorrect Calculation of Buffer Size vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a memory corruption that leads to a rpd crash. 











When
the logical interface using a routing instance flaps continuously, specific updates are sent to the jflow/sflow modules. This results in memory corruption, leading to an rpd crash and restart. 


Continued receipt of these specific updates will cause a sustained Denial of Service condition.


This issue affects Junos OS:

  *  All versions before 21.2R3-S9, 
  *  All versions of 21.4, 
  *  All versions of 22.2, 
  *  from 22.4 before 22.4R3-S7, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S4, 
  *  from 24.2 before 24.2R2.


Junos OS Evolved: 



  *  All versions of 21.2-EVO, 
  *  All versions of 21.4-EVO, 
  *  All versions of 22.2-EVO, 
  *  from 22.4 before 22.4R3-S7-EVO, 
  *  from 23.2 before 23.2R2-S3-EVO, 
  *  from 23.4 before 23.4R2-S4-EVO, 
  *  from 24.2 before 24.2R2-EVO.
Problem types: cwe_id: CWE-131
description: CWE-131 Incorrect Calculation of Buffer Size
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T14:42:20.206Z
CVE-2025-52958 Junos OS and Junos OS Evolved: When route validation is enabled, BGP connection establishment failure causes RPD crash
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).On all Junos OS and Junos OS Evolved devices, when route validation is enabled, a rare condition during BGP initial session establishment can lead to an rpd crash and restart. This occurs specifically when the connection request fails during error-handling scenario.

Continued session establishment failures leads to a sustained DoS condition. 

This issue affects Junos OS:

  *  All versions before 22.2R3-S6, 
  *  from 22.4 before 22.4R3-S6, 
  *  from 23.2 before 23.2R2-S3, 
  *  from 23.4 before 23.4R2-S4, 
  *  from 24.2 before 24.2R2; 



Junos OS Evolved: 
  *  All versions before 22.2R3-S6-EVO, 
  *  from 22.4 before 22.4R3-S6-EVO,
  *  from 23.2 before 23.2R2-S3-EVO,
  *  from 23.4 before 23.4R2-S4-EVO, 
  *  from 24.2 before 24.2R2-EVO.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T14:43:38.431Z
CVE-2025-52960 Junos OS: SRX Series and MX Series: Receipt of specific SIP packets in a high utilization situation causes a flowd/mspmand crash
A Buffer Copy without Checking Size of Input vulnerability in the 

Session Initialization Protocol (SIP) ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When memory utilization is high, and specific SIP packets are received, flowd/mspmand crashes. While the system recovers automatically, the disruption can significantly impact service stability. Continuous receipt of these specific SIP packets, while high utilization is present, will cause a sustained DoS condition. The utilization is outside the attackers control, so they would not be able to deterministically exploit this.
This issue affects Junos OS on SRX Series and MX Series: 


  *  All versions before 22.4R3-S7,
  *  from 23.2 before 23.2R2-S4, 
  *  from 23.4 before 23.4R2-S5, 
  *  from 24.2 before 24.2R2.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-09T15:40:20.193Z
CVE-2025-52961 Junos OS Evolved: PTX Series except PTX10003: An unauthenticated adjacent attacker sending specific valid traffic can cause a memory leak in cfmman leading to FPC crash and restart
An Uncontrolled Resource Consumption vulnerability in the Connectivity Fault Management (CFM) daemon and the Connectivity Fault Management Manager (cfmman) of Juniper Networks Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, PTX10016  allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

An attacker on an adjacent device sending specific valid traffic can cause cfmd to spike the CPU to 100% and cfmman's memory to leak, eventually to cause the FPC crash and restart.

Continued receipt and processes of these specific valid packets will sustain the Denial of Service (DoS) condition.

An indicator of compromise is to watch for an increase in cfmman memory rising over time by issuing the following command and evaluating the RSS number. If the RSS is growing into GBs then consider restarting the device to temporarily clear memory.
 
  user@device> show system processes node fpc<num> detail | match cfmman

Example: 

  show system processes node fpc0 detail | match cfmman 
  F S UID        PID       PPID  PGID   SID   C PRI  NI  ADDR SZ    WCHAN    RSS     PSR STIME TTY          TIME     CMD
  4 S root      15204     1    15204  15204  0  80  0   - 90802     -      113652   4  Sep25 ?           00:15:28 /usr/bin/cfmman -p /var/pfe -o -c /usr/conf/cfmman-cfg-active.xml
This issue affects Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, PTX10016:

  *  from 23.2R1-EVO before 23.2R2-S4-EVO, 
  *  from 23.4 before 23.4R2-S4-EVO, 
  *  from 24.2 before 24.2R2-EVO, 
  *  from 24.4 before 24.4R1-S2-EVO, 24.4R2-EVO.


This issue does not affect Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, PTX10016  before 23.2R1-EVO.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-10-09T15:40:52.572Z
CVE-2025-52963 Junos OS: A low-privileged user can disable an interface
An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an interface, leading to a Denial-of-Service.

Users with "view" permissions can run a specific request interface command which allows the user to shut down the interface.
This issue affects Junos OS: 


  *  All versions before 21.2R3-S9, 
  *  from 21.4 before 21.4R3-S11, 
  *  from 22.2 before 22.2R3-S7,
  *  from 22.4 before 22.4R3-S7, 
  *  from 23.2 before 23.2R2-S4,
  *  from 23.4 before 23.4R2-S5,  
  *  from 24.2 before 24.2R2-S1, 
  *  from 24.4 before 24.4R1-S3, 24.4R2.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:06:26.737Z
CVE-2025-52964 Junos OS and Junos OS Evolved: Receipt of a specific BGP UPDATE causes an rpd crash on devices with BGP multipath configured
A Reachable Assertion vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).

When the device receives a specific BGP UPDATE packet, the rpd crashes and restarts. Continuous receipt of this specific packet will cause a sustained DoS condition.

For the issue to occur, BGP multipath with "pause-computation-during-churn" must be configured on the device, and the attacker must send the paths via a BGP UPDATE from a established BGP peer.

This issue affects:
Junos OS: 
  *  All versions before 21.4R3-S7, 
  *  from 22.3 before 22.3R3-S3, 
  *  from 22.4 before 22.4R3-S5, 
  *  from 23.2 before 23.2R2, 
  *  from 23.4 before 23.4R2.



Junos OS Evolved: 
  *  All versions before 21.4R3-S7-EVO, 
  *  from 22.3 before 22.3R3-S3-EVO, 
  *  from 22.4 before 22.4R3-S5-EVO, 
  *  from 23.2 before 23.2R2-EVO, 
  *  from 23.4 before 23.4R2-EVO.
Problem types: cwe_id: CWE-617
description: CWE-617 Reachable Assertion
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
vendor: Juniper Networks
product: Junos OS Evolved
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:06:49.951Z
CVE-2025-52967 
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: lfprojects
product: MLflow
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2025-06-23T00:00:00.000Z
CVE-2025-52968 
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
Problem types: cwe_id: CWE-420
description: CWE-420 Unprotected Alternate Channel
Affected products: vendor: freedesktop
product: xdg-utils
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 2.7
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Published: 2025-06-23T00:00:00.000Z
CVE-2025-52970 
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Problem types: cwe_id: CWE-233
description: Improper access control
Affected products: vendor: Fortinet
product: FortiWeb
cpes: cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
Published: 2025-08-12T18:59:25.817Z
CVE-2025-52980 Junos OS: SRX300 Series: rpd will crash upon receiving a specific, valid BGP UPDATE message
A Use of Incorrect Byte Ordering 

vulnerability 

in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).



When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart.

This issue affects eBGP and iBGP over IPv4 and IPv6.



This issue affects:

Junos OS:



  *  22.1 versions from 22.1R1 before 22.2R3-S4,
  *  22.3 versions before 22.3R3-S3,
  *  22.4 versions before 22.4R3-S2,
  *  23.2 versions before 23.2R2,
  *  23.4 versions before 23.4R2.
Problem types: cwe_id: CWE-198
description: CWE-198 Use of Incorrect Byte Ordering
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:08:15.638Z
CVE-2025-52981 Junos OS: SRX Series: Sequence of specific PIM packets causes a flowd crash
An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on 








SRX1600, SRX2300, SRX 4000 Series, and SRX5000 Series with SPC3



allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

If a sequence of specific PIM packets is received, this will cause a flowd crash and restart.


This issue affects Junos OS:



  *  all versions before 21.2R3-S9,
  *  21.4 versions before 21.4R3-S11,
  *  22.2 versions before 22.2R3-S7,
  *  22.4 versions before 22.4R3-S6,
  *  23.2 versions before 23.2R2-S4,
  *  23.4 versions before 23.4R2-S4,
  *  24.2 versions before 24.2R2.







This is a similar, but different vulnerability than the issue reported as

CVE-2024-47503, published in JSA88133.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:08:33.384Z
CVE-2025-52982 Junos OS: MX Series: When specific SIP packets are processed the MS-MPC will crash
An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When an MX Series device with an MS-MPC is configured with two or more service sets which are both processing SIP calls, a specific sequence of call events will lead to a crash and restart of the MS-MPC.
This issue affects Junos OS:



  *  all versions before 21.2R3-S9,
  *  21.4 versions from 21.4R1,
  *  22.2 versions before 22.2R3-S6,
  *  22.4 versions before 22.4R3-S6.




As the MS-MPC is EoL after Junos OS 22.4, later versions are not affected.

This issue does not affect MX-SPC3 or SRX Series devices.
Problem types: cwe_id: CWE-404
description: CWE-404 Improper Resource Shutdown or Release
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-11T15:08:53.931Z
CVE-2025-52983 Junos OS: After removing ssh public key authentication root can still log in
A UI Discrepancy for Security Feature

vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device.



On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root.
This issue affects Junos OS:



  *  all versions before 22.2R3-S7,
  *  22.4 versions before 22.4R3-S5,
  *  23.2 versions before 23.2R2-S3,
  *  23.4 versions before 23.4R2-S3,
  *  24.2 versions before 24.2R1-S2, 24.2R2.
Problem types: cwe_id: CWE-446
description: CWE-446 UI Discrepancy for Security Feature
Affected products: vendor: Juniper Networks
product: Junos OS
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-07-11T15:09:18.207Z