CVE-2025-52951 in Junos OS
Summary
by MITRE • 07/11/2025
A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface.
Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria.
This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability.
This issue affects Junos OS:
* all versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S2, 24.4R2.
This is a more complete fix for previously published CVE-2024-21607 (JSA75748).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/07/2026
This vulnerability represents a critical protection mechanism failure within Juniper Networks Junos OS kernel filter processing that fundamentally undermines network security controls. The flaw specifically impacts the handling of IPv6 traffic destined for network devices running affected Junos OS versions, creating a scenario where configured firewall filtering becomes completely ineffective for control plane traffic. The technical root cause lies in the improper implementation of the 'payload-protocol' match functionality within kernel filters, which results in filter terms containing this match condition being processed as unconditional accept rules rather than applying proper filtering logic. This misconfiguration effectively creates a backdoor that allows attackers to bypass all firewall protections configured on interfaces, particularly those protecting the device's control plane. The vulnerability's impact is particularly severe because it operates at the kernel level, making it difficult to detect and exploit without specialized knowledge of the underlying system architecture.
The operational implications of this vulnerability extend beyond simple firewall bypass to represent a fundamental compromise of network security posture. Attackers can leverage this weakness to send IPv6 traffic that would normally be filtered or blocked, potentially gaining unauthorized access to critical network infrastructure components. The vulnerability specifically targets control plane traffic, which includes management interfaces, routing protocols, and other essential network functions that require robust protection. Security administrators may not immediately detect this issue because the filter terms appear to function normally in configuration, but they actually process all traffic as accepted, creating a false sense of security. This vulnerability affects the core network infrastructure protection mechanisms that organizations rely upon to maintain secure network operations and prevent unauthorized access to critical systems.
The technical flaw manifests as a complete failure in kernel filter processing logic where the 'payload-protocol' match element is ignored during packet processing, causing all filter terms containing this element to function as unconditional accept rules. This behavior creates a situation where firewall policies that should restrict traffic based on protocol characteristics become completely ineffective, essentially allowing all packets to pass through without proper filtering. The vulnerability affects multiple release branches of Junos OS, indicating it is a persistent issue across different version lines, and requires specific version targeting for remediation. Organizations using affected versions must understand that their configured firewall policies are not providing the expected protection, potentially exposing their network infrastructure to various attack vectors including denial of service, unauthorized access, and information disclosure. The issue affects only control plane traffic filtering, meaning transit traffic remains protected, but this limited scope does not diminish the severity of the vulnerability's impact on network security.
The security implications of this vulnerability align with CWE-119 and CWE-121, which address memory corruption and buffer overflow conditions that can lead to privilege escalation and unauthorized access. This vulnerability also maps to ATT&CK technique T1071.004 for application layer protocol usage and T1566 for phishing attacks that could exploit the bypassed controls. Organizations must prioritize immediate remediation by upgrading to patched versions of Junos OS, specifically targeting the version ranges mentioned in the advisory. The vulnerability represents a significant risk to network security operations and requires comprehensive testing of existing firewall policies to verify their continued effectiveness after patching. Network administrators should also implement additional monitoring and logging controls to detect potential exploitation attempts and ensure that the patched systems maintain proper filtering behavior. This vulnerability serves as a reminder of the critical importance of kernel-level security controls and the need for thorough testing of security features before deployment in production environments. The issue also highlights the necessity of maintaining up-to-date security patches and the potential consequences of delayed patch management in network infrastructure environments.