CVE-2025-52982: Junos OS: MX Series: When specific SIP packets are processed the MS-MPC will crash
An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).
When an MX Series device with an MS-MPC is configured with two or more service sets which are both processing SIP calls, a specific sequence of call events will lead to a crash and restart of the MS-MPC. This issue affects Junos OS:
all versions before 21.2R3-S9, 21.4 versions from 21.4R1, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3-S6.
As the MS-MPC is EoL after Junos OS 22.4, later versions are not affected.
This issue does not affect MX-SPC3 or SRX Series devices.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52982?
CVE-2025-52982 is classified as a high-severity vulnerability due to its potential to cause a Denial-of-Service (DoS) attack.
How do I fix CVE-2025-52982?
To mitigate CVE-2025-52982, upgrade the Junos OS on MX Series devices with MS-MPC to version 22.4R3-S7 or later.
Which devices are affected by CVE-2025-52982?
CVE-2025-52982 affects Juniper Networks MX Series devices operating on Junos OS with MS-MPC configured with specific versions.
What impact does CVE-2025-52982 have on network security?
CVE-2025-52982 allows unauthenticated attackers to cause a Denial-of-Service, potentially disrupting network availability.
Is there a workaround for CVE-2025-52982?
As of now, the recommended solution is to apply the software update; no official workaround has been provided for CVE-2025-52982.