CVE-2025-21601: Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device
First published: Wed Apr 09 2025(Updated: )
An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive. Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition. This issue affects Junos OS: * All versions before 21.4R3-S9, * from 22.2 before 22.2R3-S5, * from 22.4 before 22.4R3-S4, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R1-S1, 24.2R2. An indicator of compromise is to review the CPU % of the httpd process in the CLI: e.g. show system processes extensive | match httpd PID nobody 52 0 20M 191M select 2 0:01 80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper JUNOS | <21.4R3-S9>=undefined>=undefined>=undefined>=undefined>=undefined |
Remedy
The following software releases have been updated to resolve this specific issue: Junos OS: 21.4R3-S9, 22.2R3-S5, 22.4R3-S4, 23.2R2-S3, 23.4R2-S3, 24.2R1-S1, 24.2R2, 24.4R1, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-21601?
CVE-2025-21601 is classified as a high-severity vulnerability due to its potential impact on network security.
How do I fix CVE-2025-21601?
The fix for CVE-2025-21601 involves upgrading to the latest version of Junos OS that addresses this vulnerability.
Who is affected by CVE-2025-21601?
CVE-2025-21601 affects users of Juniper Networks Junos OS on specific SRX Series, EX Series, MX240, MX480, MX960, and QFX5120 models.
What type of attacks can CVE-2025-21601 allow?
CVE-2025-21601 may allow an unauthenticated, network-based attacker to exploit the vulnerability potentially leading to unauthorized access.
Is there a known workaround for CVE-2025-21601?
There are no known workarounds for CVE-2025-21601 other than applying the relevant software updates.
- agent/title
- agent/references
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/severity
- agent/source
- agent/author
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/last-modified-date
- agent/event
- vendor/juniper networks
- canonical/juniper junos