CVE-2025-52989: Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration
An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration.
A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration.
This issue affects:
Junos OS:
all versions before 22.2R3-S7, 22.4 versions before 22.4R3-S7, 23.2 versions before 23.2R2-S4, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R1-S2, 24.4R2;
Junos OS Evolved:
all versions before 22.4R3-S7-EVO, 23.2-EVO versions before 23.2R2-S4-EVO, 23.4-EVO versions before 23.4R2-S5-EVO, 24.2-EVO versions before 24.2R2-S1-EVO
24.4-EVO versions before 24.4R2-EVO.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52989?
CVE-2025-52989 is classified as a high severity vulnerability due to its potential for unauthorized modification of system configurations.
How do I fix CVE-2025-52989?
To remediate CVE-2025-52989, upgrade your Junos OS or Junos OS Evolved to the latest non-vulnerable versions as recommended by Juniper Networks.
Who is affected by CVE-2025-52989?
CVE-2025-52989 affects users of Juniper Networks Junos OS and Junos OS Evolved versions up to specific vulnerable releases.
What type of attack does CVE-2025-52989 enable?
CVE-2025-52989 allows a local, authenticated attacker with high privileges to improperly modify system configuration.
What software is vulnerable to CVE-2025-52989?
CVE-2025-52989 affects multiple versions of Juniper Networks Junos OS and Junos OS Evolved, including several prior to their latest releases.