Product:
Junos OS Evolved
Summary
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine of Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to impact confidentiality and availability. When an output firewall filter is configured with terms where the action is ‘reject’, packets matching these terms are erroneously sent to the Routing Engine, consuming limited resources. This issue only applies to firewall filters on WAN or revenue interfaces.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.9 | CVE-2025-59958 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted packets that match the reject terms in the output firewall filter. These packets will be processed by the Routing Engine, leading to resource consumption and potential exposure of confidential information. The attacker does not need any privileges or user interaction to carry out this attack, making it easier to exploit.
Affected Products
- Junos OS Evolved on PTX Series: All versions before 22.4R3-EVO
- Junos OS Evolved on PTX Series: 23.2 versions before 23.2R2-EVO
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Junos OS Evolved that are not affected by this issue. Additionally, review and adjust firewall filter configurations to avoid using reject actions that could lead to this vulnerability being exploited.