PT-2025-1073 · Juniper Networks · Junos

Published 2025-01-08 · Updated 2026-01-26 · CVE-2025-21592

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Junos OS SRX Series versions prior to 21.4R3-S8 Junos OS SRX Series versions 22.2 through 22.2R3-S5 Junos OS SRX Series versions 22.3 through 22.3R3-S3 Junos OS SRX Series versions 22.4 through 22.4R3-S2 Junos OS SRX Series versions 23.2 through 23.2R2-S1 Junos OS SRX Series versions 23.4 through 23.4R2

Description The issue is related to insufficient protection of sensitive data in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices. This allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system. By executing either the show services advanced-anti-malware or show services security-intelligence command, a user with limited permissions can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.

Recommendations For versions prior to 21.4R3-S8, update to version 21.4R3-S8 or later. For versions 22.2 through 22.2R3-S5, update to version 22.2R3-S5 or later. For versions 22.3 through 22.3R3-S3, update to version 22.3R3-S3 or later. For versions 22.4 through 22.4R3-S2, update to version 22.4R3-S2 or later. For versions 23.2 through 23.2R2-S1, update to version 23.2R2-S1 or later. For versions 23.4 through 23.4R2, update to version 23.4R2 or later. As a temporary workaround, consider restricting access to the show services advanced-anti-malware and show services security-intelligence commands until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-00307

CVE-2025-21592

Affected Products

Junos

References · 8

• https://bdu.fstec.ru/vul/2025-00307 · Security Note
• https://supportportal.juniper.net/JSA92860 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-21592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21592 · Security Note
• https://twitter.com/CVEnew/status/1877398159166509533 · Twitter Post
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-highly-sensitive-information-on-file-system-CVE-2025-21592?language=en_US · Note
• https://t.me/cveNotify/149914 · Telegram Post
• https://t.me/cvedetector/14875 · Telegram Post