PT-2025-41400 · Juniper Networks · Junos Evolved

Published

2025-10-09

·

Updated

2025-10-09

·

CVE-2025-52961

CVSS v4.0

7.1

High

VectorAV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions 23.2R1-EVO through 23.2R2-S4-EVO Juniper Networks Junos OS Evolved versions 23.4 through 23.4R2-S4-EVO Juniper Networks Junos OS Evolved versions 24.2 through 24.2R2-EVO Juniper Networks Junos OS Evolved versions 24.4 through 24.4R1-S2-EVO and 24.4R2-EVO
Description An uncontrolled resource consumption issue exists in the Connectivity Fault Management (CFM) daemon (cfmd) and the Connectivity Fault Management Manager (cfmman) of Juniper Networks Junos OS Evolved. An unauthenticated, adjacent attacker can send specific valid traffic to cause a Denial-of-Service (DoS) condition. The attacker can cause cfmd to experience high CPU usage and cfmman to leak memory, potentially leading to a Fast Path Controller (FPC) crash and restart. Continued transmission of these packets sustains the DoS. Monitoring cfmman memory usage using the command show system processes node fpc<num> detail | match cfmman and observing a growing Resident Set Size (RSS) in gigabytes can indicate a compromise.
Recommendations Upgrade to Junos OS Evolved version 23.2R2-S4-EVO or later. Upgrade to Junos OS Evolved version 23.4R2-S4-EVO or later. Upgrade to Junos OS Evolved version 24.2R2-EVO or later. Upgrade to Junos OS Evolved version 24.4R1-S2-EVO or later, or 24.4R2-EVO or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-52961

Affected Products

Junos Evolved