PT-2025-29253 · Juniper Networks · Junos

Published 2025-07-09 · Updated 2026-01-23 · CVE-2025-52983

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 22.2R3-S7 Juniper Networks Junos OS versions 22.4 through 22.4R3-S5 Juniper Networks Junos OS versions 23.2 through 23.2R2-S3 Juniper Networks Junos OS versions 23.4 through 23.4R2-S3 Juniper Networks Junos OS versions 24.2 through 24.2R1-S2, 24.2R2

Description: A UI discrepancy exists in Juniper Networks Junos OS on VM Host systems, allowing a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users possessing the corresponding private key can still log in as root.

Recommendations: Update to Junos OS version 22.2R3-S7 or later. Update to Junos OS version 22.4R3-S5 or later. Update to Junos OS version 23.2R2-S3 or later. Update to Junos OS version 23.4R2-S3 or later. Update to Junos OS version 24.2R1-S2 or later. Update to Junos OS version 24.2R2 or later.

Fix

Weakness Enumeration

CWE-446

Related Identifiers

BDU:2025-08754

CVE-2025-52983

Affected Products

Junos

References · 8

• https://bdu.fstec.ru/vul/2025-08754 · Security Note
• https://supportportal.juniper.net/JSA100089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52983 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52983 · Vendor Advisory
• https://juniper.net/documentation/us/en/software/junos/junos-install-upgrade/topics/topic-map/vm-host-overview.html#id-routing-engines-with-vm-host-support · Note
• https://twitter.com/CVEnew/status/1943700203262877937 · Twitter Post
• https://t.me/cveNotify/149723 · Telegram Post
• https://t.me/cvetracker/27570 · Telegram Post