PT-2025-1009 · Juniper Networks · Junos+1

Published

2025-01-08

·

Updated

2025-01-14

·

CVE-2025-21598

CVSS v4.0

8.2

High

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber
Name of the Vulnerable Software and Affected Versions: Junos OS versions 21.2R3-S8 through 21.2R3-S9 Junos OS versions 21.4R3-S7 through 21.4R3-S9 Junos OS versions 22.2R3-S4 through 22.2R3-S5 Junos OS versions 22.3R3-S2 through 22.3R3-S4 Junos OS versions 22.4R3 through 22.4R3-S5 Junos OS versions 23.2R2 through 23.2R2-S2 Junos OS versions 23.4R1 through 23.4R2-S1 Junos OS version 24.2R1 through 24.2R1-S1 Junos OS version 24.2R2 Junos OS Evolved versions 21.4R3-S7-EVO through 21.4R3-S9-EVO Junos OS Evolved versions 22.2R3-S4-EVO through 22.2R3-S5-EVO Junos OS Evolved versions 22.3R3-S2-EVO through 22.3R3-S4-EVO Junos OS Evolved versions 22.4R3-EVO through 22.4R3-S5-EVO Junos OS Evolved versions 23.2R2-EVO through 23.2R2-S2-EVO Junos OS Evolved versions 23.4R1-EVO through 23.4R2-S1-EVO Junos OS Evolved version 24.2R1-EVO through 24.2R1-S2-EVO Junos OS Evolved version 24.2R2-EVO
Description: The issue is related to an out-of-bounds read vulnerability in the routing protocol daemon (rpd) of Juniper Networks' Junos OS and Junos OS Evolved. This vulnerability allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled, causing the rpd daemon to crash. The issue can propagate and multiply through multiple ASes until reaching vulnerable devices, affecting both iBGP and eBGP, as well as IPv4 and IPv6. An indicator of compromise may be the presence of malformed update messages in a neighboring AS.
Recommendations: For Junos OS versions 21.2R3-S8 through 21.2R3-S9, update to version 21.2R3-S9 or later. For Junos OS versions 21.4R3-S7 through 21.4R3-S9, update to version 21.4R3-S9 or later. For Junos OS versions 22.2R3-S4 through 22.2R3-S5, update to version 22.2R3-S5 or later. For Junos OS versions 22.3R3-S2 through 22.3R3-S4, update to version 22.3R3-S4 or later. For Junos OS versions 22.4R3 through 22.4R3-S5, update to version 22.4R3-S5 or later. For Junos OS versions 23.2R2 through 23.2R2-S2, update to version 23.2R2-S2 or later. For Junos OS versions 23.4R1 through 23.4R2-S1, update to version 23.4R2-S1 or later. For Junos OS version 24.2R1 through 24.2R1-S1, update to version 24.2R1-S1 or later. For Junos OS version 24.2R2, update to a later version. For Junos OS Evolved versions 21.4R3-S7-EVO through 21.4R3-S9-EVO, update to version 21.4R3-S9-EVO or later. For Junos OS Evolved versions 22.2R3-S4-EVO through 22.2R3-S5-EVO, update to version 22.2R3-S5-EVO or later. For Junos OS Evolved versions 22.3R3-S2-EVO through 22.3R3-S4-EVO, update to version 22.3R3-S4-EVO or later. For Junos OS Evolved versions 22.4R3-EVO through 22.4R3-S5-EVO, update to version 22.4R3-S5-EVO or later. For Junos OS Evolved versions 23.2R2-EVO through 23.2R2-S2-EVO, update to version 23.2R2-S2-EVO or later. For Junos OS Evolved versions 23.4R1-EVO through 23.4R2-S1-EVO, update to version 23.4R2-S1-EVO or later. For Junos OS Evolved version 24.2R1-EVO through 24.2R1-S2-EVO, update to version 24.2R1-S2-EVO or later. For Junos OS Evolved version 24.2R2-EVO, update to a later version. As a temporary workaround, consider disabling the packet receive trace options until a patch is available.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2025-00157
CVE-2025-21598

Affected Products

Junos
Junos Evolved