Product:
Junos OS
Summary
An Untrusted Pointer Dereference vulnerability in the routing protocol daemon of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to cause a Denial-of-Service. Executing the command ‘show route < ( receive-protocol | advertising-protocol ) bgp > detail’ with specific route attributes can lead to an rpd crash and restart. The issue affects multiple versions of both Junos OS and Junos OS Evolved.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2025-59959 |
Exploitation
To exploit this vulnerability, an attacker must have local access and low privileges on the affected system. By executing the specific command that queries the routing protocol daemon with certain attributes, the attacker can trigger a crash of the rpd process, resulting in a Denial-of-Service condition. This requires knowledge of the system’s routing configuration and the ability to execute commands on the device.
Affected Products
- Junos OS: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2
- Junos OS Evolved: all versions before 22.4R3-S8-EVO, 23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of Junos OS and Junos OS Evolved that are not affected by this issue. Regularly applying security updates and patches provided by Juniper Networks is essential to protect against potential exploits. Additionally, limiting local access to trusted personnel can help reduce the risk of exploitation.