Product:
Junos OS
Summary
A NULL Pointer Dereference vulnerability in the chassis daemon of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service (DoS). When a user executes the ‘show chassis’ command with specifically crafted options, chassisd will crash and restart, leading to a complete service outage. The system automatically recovers from this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2025-60007 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can execute the ‘show chassis’ command with specially crafted options. This will cause the chassisd process to crash and restart, resulting in a Denial-of-Service condition for all components except the Routing Engine in the chassis.
Affected Products
- Junos OS on MX Series: All versions before 22.4R3-S8
- Junos OS on SRX Series: 23.2 versions before 23.2R2-S5
- Junos OS on EX Series: 23.4 versions before 23.4R2-S6
- Junos OS on MX, SRX, and EX Series: 24.2 versions before 24.2R2-S2
- Junos OS on MX, SRX, and EX Series: 24.4 versions before 24.4R2
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of Junos OS that are not affected by this issue. Regularly applying security updates and patches can help prevent exploitation of this vulnerability.