Juniper Junos OS up to 22.4R3-S6/23.2R2-S3/23.4R2-S4/24.2R1 Session Initialization Protocol buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Juniper Junos OS up to 22.4R3-S6/23.2R2-S3/23.4R2-S4/24.2R1. Affected by this issue is some unknown functionality of the component Session Initialization Protocol. Performing a manipulation results in buffer overflow. This vulnerability is known as CVE-2025-52960. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Juniper Junos OS up to 22.4R3-S6/23.2R2-S3/23.4R2-S4/24.2R1. This affects some unknown functionality of the component Session Initialization Protocol. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on availability. The summary by CVE is:

A Buffer Copy without Checking Size of Input vulnerability in the Session Initialization Protocol (SIP) ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When memory utilization is high, and specific SIP packets are received, flowd/mspmand crashes. While the system recovers automatically, the disruption can significantly impact service stability. Continuous receipt of these specific SIP packets, while high utilization is present, will cause a sustained DoS condition. The utilization is outside the attackers control, so they would not be able to deterministically exploit this. This issue affects Junos OS on SRX Series and MX Series:  * All versions before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2025-52960 since 06/23/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/01/2025).

The vulnerability scanner Nessus provides a plugin with the ID 269730 (Juniper Junos OS Vulnerability (JSA103143)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 22.4R3-S7, 23.2R2-S4, 23.4R2-S5 or 24.2R2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (269730), EUVD (EUVD-2025-33402) and CERT Bund (WID-SEC-2025-2238). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Juniper JUNOS

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 22.4R3-S6
• 23.2R2-S3
• 23.4R2-S4
• 24.2R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion