CVE-2025-52951: Junos OS: IPv6 firewall filter fails to match payload-protocol

Published Jul 11, 2025
·
Updated

A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface.

Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria.

This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability.

This issue affects Junos OS:

all versions before 21.2R3-S9,  from 21.4 before 21.4R3-S11,  from 22.2 before 22.2R3-S7,  from 22.4 before 22.4R3-S7,  from 23.2 before 23.2R2-S4,  from 23.4 before 23.4R2-S5,  from 24.2 before 24.2R2-S1,  from 24.4 before 24.4R1-S2, 24.4R2.

This is a more complete fix for previously published CVE-2024-21607 (JSA75748).

Affected Software

89 affected components
Juniper Networks Junos OS<21.2R3-S9, >=21.4<21.4R3-S11, >=22.2<22.2R3-S7, >=22.4<22.4R3-S7, >=23.2<23.2R2-S4, >=23.4
Juniper Junos<21.2
Juniper Junos=21.2
Juniper Junos=21.2-r1
Juniper Junos=21.2-r1-s1
Juniper Junos=21.2-r1-s2
Juniper Junos=21.2-r2
Juniper Junos=21.2-r2-s1
Juniper Junos=21.2-r2-s2
Juniper Junos=21.2-r3
Juniper Junos=21.2-r3-s1
Juniper Junos=21.2-r3-s2
Juniper Junos=21.2-r3-s3
Juniper Junos=21.2-r3-s4
Juniper Junos=21.2-r3-s5
Juniper Junos=21.2-r3-s6
Juniper Junos=21.2-r3-s7
Juniper Junos=21.2-r3-s8
Juniper Junos=21.4
Juniper Junos=21.4-r1
Juniper Junos=21.4-r1-s1
Juniper Junos=21.4-r1-s2
Juniper Junos=21.4-r2
Juniper Junos=21.4-r2-s1
Juniper Junos=21.4-r2-s2
Juniper Junos=21.4-r3
Juniper Junos=21.4-r3-s1
Juniper Junos=21.4-r3-s10
Juniper Junos=21.4-r3-s2
Juniper Junos=21.4-r3-s3
Juniper Junos=21.4-r3-s4
Juniper Junos=21.4-r3-s5
Juniper Junos=21.4-r3-s6
Juniper Junos=21.4-r3-s7
Juniper Junos=21.4-r3-s8
Juniper Junos=21.4-r3-s9
Juniper Junos=22.2
Juniper Junos=22.2-r1
Juniper Junos=22.2-r1-s1
Juniper Junos=22.2-r1-s2
Juniper Junos=22.2-r2
Juniper Junos=22.2-r2-s1
Juniper Junos=22.2-r2-s2
Juniper Junos=22.2-r3
Juniper Junos=22.2-r3-s1
Juniper Junos=22.2-r3-s2
Juniper Junos=22.2-r3-s3
Juniper Junos=22.2-r3-s4
Juniper Junos=22.2-r3-s5
Juniper Junos=22.2-r3-s6
Juniper Junos=22.4
Juniper Junos=22.4-r1
Juniper Junos=22.4-r1-s1
Juniper Junos=22.4-r1-s2
Juniper Junos=22.4-r2
Juniper Junos=22.4-r2-s1
Juniper Junos=22.4-r2-s2
Juniper Junos=22.4-r3
Juniper Junos=22.4-r3-s1
Juniper Junos=22.4-r3-s2
Juniper Junos=22.4-r3-s3
Juniper Junos=22.4-r3-s4
Juniper Junos=22.4-r3-s5
Juniper Junos=22.4-r3-s6
Juniper Junos=23.2
Juniper Junos=23.2-r1
Juniper Junos=23.2-r1-s1
Juniper Junos=23.2-r1-s2
Juniper Junos=23.2-r2
Juniper Junos=23.2-r2-s1
Juniper Junos=23.2-r2-s2
Juniper Junos=23.2-r2-s3
Juniper Junos=23.4
Juniper Junos=23.4-r1
Juniper Junos=23.4-r1-s1
Juniper Junos=23.4-r1-s2
Juniper Junos=23.4-r2
Juniper Junos=23.4-r2-s1
Juniper Junos=23.4-r2-s2
Juniper Junos=23.4-r2-s3
Juniper Junos=23.4-r2-s4
Juniper Junos=24.2
Juniper Junos=24.2-r1
Juniper Junos=24.2-r1-s1
Juniper Junos=24.2-r1-s2
Juniper Junos=24.2-r2
Juniper Junos=24.4
Juniper Junos=24.4-r1
Juniper Junos=24.4-r2

Remediation

Information

The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S11, 22.2R3-S7, 22.4R3-S7, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S2, 24.4R2, 25.2R1, and all subsequent releases.

Event History

Jul 11, 2025
CVE Published
via MITRE·02:41 PM
Data Sourced
via MITRE·02:41 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-52951?

CVE-2025-52951 is classified as a high severity vulnerability due to its potential for firewall filtering bypass that can lead to further network exploitations.

2

How does CVE-2025-52951 impact Juniper Networks Junos OS?

CVE-2025-52951 allows attackers to bypass firewall configurations on interfaces handling IPv6 traffic due to a protection mechanism failure in the kernel filter processing.

3

Which versions of Junos OS are affected by CVE-2025-52951?

CVE-2025-52951 affects Juniper Networks Junos OS versions from 21.4 up to 24.4R1-S2, including specific intermediate versions.

4

How do I fix CVE-2025-52951?

To mitigate CVE-2025-52951, it is recommended to upgrade impacted versions of Junos OS to the latest patched release.

5

Can CVE-2025-52951 be exploited remotely?

Yes, CVE-2025-52951 can be exploited remotely by sending crafted IPv6 traffic to the affected interfaces.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203