Juniper Junos OS/Junos OS Evolved Routing Protocol Daemon expected behavior violation

Summaryinfo

A vulnerability was found in Juniper Junos OS and Junos OS Evolved. It has been rated as critical. This issue affects some unknown processing of the component Routing Protocol Daemon. Performing a manipulation results in expected behavior violation. This vulnerability is known as CVE-2025-52953. Access to the local network is required for this attack. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in Juniper Junos OS and Junos OS Evolved (version unknown). This affects an unknown function of the component Routing Protocol Daemon. The manipulation with an unknown input leads to a expected behavior violation vulnerability. CWE is classifying the issue as CWE-440. A feature, API, or function does not perform according to its specification. This is going to have an impact on availability. The summary by CVE is:

An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a valid BGP UPDATE packet to cause a BGP session reset, resulting in a Denial of Service (DoS).  Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue affects iBGP and eBGP and both IPv4 and IPv6 are affected by this vulnerability. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2, * from 24.4 before 24.4R1-S3, 24.4R2 Junos OS Evolved: * All versions before 22.2R3-S7-EVO, * from 22.4-EVO before 22.4R3-S7-EVO, * from 23.2-EVO before 23.2R2-S4-EVO, * from 23.4-EVO before 23.4R2-S4-EVO, * from 24.2-EVO before 24.2R2-EVO, * from 24.4-EVO before 24.4R1-S3-EVO, 24.4R2-EVO.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2025-52953 since 06/23/2025. The exploitability is told to be easy. The attack needs to approached within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 241651 (Juniper Junos OS Vulnerability (JSA100059)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (241651) and CERT Bund (WID-SEC-2025-1519). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Juniper MX Series
• Juniper JUNOS
• Juniper SRX Series
• Juniper Security Director
• Juniper Junos Space

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS
• Junos OS Evolved

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion