Product:
Junos OS
Summary
A Buffer Over-read vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service. When an affected device receives a BGP update with specific optional transitive attributes, the routing protocol daemon will crash and restart. This issue primarily affects devices with non-4-byte-AS capable BGP peers.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-60003 |
Exploitation
To exploit this vulnerability, an attacker must send a specially crafted BGP update containing specific optional transitive attributes to an affected device over an established peering session. If the device is configured to interact with non-4-byte-AS capable peers, it will crash and restart when attempting to process the received information, leading to a Denial-of-Service condition.
Affected Products
- Junos OS: All versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2.
- Junos OS Evolved: All versions before 22.4R3-S8-EVO, 23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated to the latest versions of Junos OS and Junos OS Evolved that are not affected by this issue. Additionally, disabling the 4-byte-AS capability in BGP configurations may help prevent exploitation, but this should be done with caution as it may affect network operations.