Juniper Junos OS/Junos OS Evolved up to 24.4R1 Routing Protocol Daemon untrusted pointer dereference

Summaryinfo

A vulnerability identified as problematic has been detected in Juniper Junos OS and Junos OS Evolved up to 22.4R3-S7/23.2R2-S4/23.4R2-S4/24.2R2-S1/24.4R1. The impacted element is an unknown function of the component Routing Protocol Daemon. Performing a manipulation results in untrusted pointer dereference. This vulnerability is cataloged as CVE-2025-59959. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Juniper Junos OS and Junos OS Evolved up to 22.4R3-S7/23.2R2-S4/23.4R2-S4/24.2R2-S1/24.4R1. This affects some unknown functionality of the component Routing Protocol Daemon. The manipulation with an unknown input leads to a untrusted pointer dereference vulnerability. CWE is classifying the issue as CWE-822. The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer. This is going to have an impact on availability. The summary by CVE is:

An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS). When the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart. 'show route ... extensive' is not affected. This issue affects: Junos OS:  * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO,  * 23.2 versions before 23.2R2-S5-EVO, * 23.4 versions before 23.4R2-S6-EVO, * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO.

The advisory is shared at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2025-59959 since 09/23/2025. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/17/2026).

Upgrading to version 22.4R3-S8, 23.2R2-S5, 23.4R2-S5, 24.2R2-S2 or 24.4R2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS
• Junos OS Evolved

Version

• 22.4R3-S7
• 23.2R2-S4
• 23.4R2-S4
• 24.2R2-S1
• 24.4R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion