Product:
Junos OS
Summary
An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon of Junos OS allows an unauthenticated, network-based attacker to cause a Denial-Of-Service. When an affected system receives a specific BGP EVPN update message over an established BGP session, this causes an rpd crash and restart. A BGP EVPN configuration is not necessary to be vulnerable.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-60004 |
Exploitation
To exploit this vulnerability, an attacker must send a specific BGP EVPN update message to a vulnerable device over an established BGP session. This can be done without any prior configuration of BGP EVPN on the device, making it possible for an attacker to trigger the Denial-Of-Service condition remotely.
Affected Products
- Junos OS: Versions 23.4R2-S3 before 23.4R2-S5, 24.2R2 before 24.2R2-S1, 24.4 before 24.4R1-S3 and 24.4R2.
- Junos OS Evolved: Versions 23.4-EVO from 23.4R2-S2-EVO before 23.4R2-S5-EVO, 24.2-EVO from 24.2R2-EVO before 24.2R2-S1-EVO, and 24.4-EVO before 24.4R1-S3-EVO and 24.4R2-EVO.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest patches provided by Juniper Networks for affected versions of Junos OS and Junos OS Evolved. Additionally, network configurations should be reviewed to limit exposure to untrusted BGP peers.