CVE-2025-21602

Jan. 9, 2025, 5:15 p.m.

7.1
High

Description

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a specific BGP update packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability. This issue affects Junos OS:  * from 21.4 before 21.4R3-S9,  * from 22.2 before 22.2R3-S5,  * from 22.3 before 22.3R3-S4, * from 22.4 before 22.4R3-S5,  * from 23.2 before 23.2R2-S3,  * from 23.4 before 23.4R2-S3,  * from 24.2 before 24.2R1-S2, 24.2R2;  This issue does not affect versions prior to 21.1R1. Junos OS Evolved:  * from 21.4 before 21.4R3-S9-EVO,  * from 22.2 before 22.2R3-S5-EVO,  * from 22.3 before 22.3R3-S4-EVO, * from 22.4 before 22.4R3-S5-EVO,  * from 23.2 before 23.2R2-S3-EVO,  * from 23.4 before 23.4R2-S3-EVO,  * from 24.2 before 24.2R1-S2-EVO, 24.2R2-EVO. This issue does not affect versions prior to 21.1R1-EVO

Product(s) Impacted

Product Versions
Junos OS
  • ['21.4 before 21.4R3-S9', '22.2 before 22.2R3-S5', '22.3 before 22.3R3-S4', '22.4 before 22.4R3-S5', '23.2 before 23.2R2-S3', '23.4 before 23.4R2-S3', '24.2 before 24.2R1-S2, 24.2R2']
Junos OS Evolved
  • ['21.4 before 21.4R3-S9-EVO', '22.2 before 22.2R3-S5-EVO', '22.3 before 22.3R3-S4-EVO', '22.4 before 22.4R3-S5-EVO', '23.2 before 23.2R2-S3-EVO', '23.4 before 23.4R2-S3-EVO', '24.2 before 24.2R1-S2-EVO, 24.2R2-EVO']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-755
Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.

References

https://supportportal.juniper.net/JSA92872

Tags

CWE-755
sirt@juniper.net
2025-01-09
CVE-2025-21602

CVSS Score

7.1 / 10

CVSS Data - 4.0

  • Attack Vector: ADJACENT
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:C/RE:M/U:Green

    View Vector String

Timeline

Published: Jan. 9, 2025, 5:15 p.m.
Last Modified: Jan. 9, 2025, 5:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

sirt@juniper.net

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.