CVE-2025-52954: Junos OS Evolved: A low-privileged user can execute arbitrary Junos commands and modify the configuration, thereby compromising the system
A Missing Authorization vulnerability in the internal virtual routing and forwarding (VRF) of Juniper Networks Junos OS Evolved allows a local, low-privileged user to gain root privileges, leading to a system compromise.
Any low-privileged user with the capability to send packets over the internal VRF can execute arbitrary Junos commands and modify the configuration, and thus compromise the system.
This issue affects Junos OS Evolved:
All versions before 22.2R3-S7-EVO, from 22.4 before 22.4R3-S7-EVO, from 23.2 before 23.2R2-S4-EVO, from 23.4 before 23.4R2-S5-EVO, from 24.2 before 24.2R2-S1-EVO from 24.4 before 24.4R1-S2-EVO, 24.4R2-EVO.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52954?
CVE-2025-52954 is rated as a high severity vulnerability due to its potential to allow low-privileged users to gain root access, compromising the system.
How do I fix CVE-2025-52954?
To fix CVE-2025-52954, upgrade your Junos OS Evolved to the latest patched version recommended by Juniper Networks.
Who is affected by CVE-2025-52954?
CVE-2025-52954 affects Juniper Networks Junos OS Evolved versions from 22.4 up to 24.4R2-EVO.
What type of vulnerability is CVE-2025-52954?
CVE-2025-52954 is a Missing Authorization vulnerability specifically in the virtual routing and forwarding (VRF) of Junos OS Evolved.
Can a remote attacker exploit CVE-2025-52954?
No, CVE-2025-52954 requires a local, low-privileged user to exploit the vulnerability for system compromise.