Juniper Junos OS up to 24.2R1-S2 UI ui discrepancy

Summaryinfo

A vulnerability identified as critical has been detected in Juniper Junos OS up to 24.2R1-S2. This vulnerability affects unknown code of the component UI. Performing a manipulation results in ui discrepancy. This vulnerability was named CVE-2025-52983. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Juniper Junos OS up to 24.2R1-S2. This affects some unknown functionality of the component UI. The manipulation with an unknown input leads to a ui discrepancy vulnerability. CWE is classifying the issue as CWE-446. The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2025-52983 since 06/23/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are necessary for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/23/2026).

Upgrading to version 22.2R3-S7, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R1-S2 or 24.2R2 eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-21147) and CERT Bund (WID-SEC-2025-1519). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Juniper MX Series
• Juniper JUNOS
• Juniper SRX Series
• Juniper Security Director
• Juniper Junos Space

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 22.2R3-S6
• 22.4R3-S4
• 23.2R2-S2
• 23.4R2-S2
• 24.2R1
• 24.2R1-S2

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion