Juniper Junos OS up to 23.2R1 BGP Update Message escape output

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 21.2R3-S8/22.2R3-S5/22.4R2/23.2R1-S2/23.2R1 and classified as problematic. This impacts an unknown function of the component BGP Update Message Handler. Such manipulation leads to escape output. This vulnerability is referenced as CVE-2025-30657. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 21.2R3-S8/22.2R3-S5/22.4R2/23.2R1-S2/23.2R1. It has been rated as problematic. Affected by this issue is an unknown code of the component BGP Update Message Handler. The manipulation with an unknown input leads to a escape output vulnerability. Using CWE to declare the problem leads to CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. Impacted is availability. CVE summarizes:

An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a device configured for flow-monitoring receives a specific BGP update message, it is correctly processed internally by the routing protocol daemon (rpd), but when it's sent to SRRD it's encoded incorrectly which leads to a crash and momentary interruption of jflow processing until it automatically restarts. This issue does not affect traffic forwarding itself. This issue affects Junos OS:  * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3, * 23.2 versions before 23.2R1-S2, 23.2R2. This issue does not affected Junos OS Evolved.

The advisory is shared for download at supportportal.juniper.net. This vulnerability is handled as CVE-2025-30657 since 03/24/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/24/2026).

The vulnerability scanner Nessus provides a plugin with the ID 234096 (Juniper Junos OS Vulnerability (JSA96467)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3, 23.2R1-S2 or 23.2R2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234096). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 21.2R3-S8
• 22.2R3-S5
• 22.4R2
• 23.2R1
• 23.2R1-S2

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion