CVE-2025-30654: Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive information
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information.
Through the execution of a specific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive information such as hashed passwords, that can be used to further impact the system.
This issue affects Junos OS: All versions before 21.4R3-S10, from 22.2 before 22.2R3-S5, from 22.4 before 22.4R3-S5, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S3.
Junos OS Evolved:
All versions before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO, from 22.4-EVO before 22.4R3-S5-EVO, from 23.2-EVO before 23.2R2-S3-EVO, from 23.4-EVO before 23.4R2-S3-EVO.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30654?
CVE-2025-30654 is classified as a medium severity vulnerability due to the exposure of sensitive information to low-privileged authenticated users.
How do I fix CVE-2025-30654?
To mitigate CVE-2025-30654, upgrade Junos OS or Junos OS Evolved to the latest version that addresses the vulnerability.
Who is affected by CVE-2025-30654?
CVE-2025-30654 affects users of Juniper Networks Junos OS and Junos OS Evolved, particularly low-privileged authenticated users.
What type of information is exposed in CVE-2025-30654?
CVE-2025-30654 allows access to sensitive information potentially impacting the confidentiality of data in the system.
Can CVE-2025-30654 be exploited remotely?
No, CVE-2025-30654 requires local access and authenticated credentials to exploit the vulnerability.