CVE-2025-59980: Junos OS: When a user with the name ftp or anonymous is configured unauthenticated filesystem access is allowed
An Authentication Bypass by Primary Weakness
in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory.
This issue affects Junos OS:
all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59980?
The severity of CVE-2025-59980 is considered high due to the potential for unauthorized access to critical system files.
How do I fix CVE-2025-59980?
To fix CVE-2025-59980, disable the FTP server or ensure that no users named 'ftp' or 'anonymous' are configured.
What versions of Juniper Networks Junos OS are affected by CVE-2025-59980?
CVE-2025-59980 affects Juniper Networks Junos OS versions up to 22.4R3-S8, 23.2R2-S3, and 23.4R2.
What type of attack does CVE-2025-59980 allow?
CVE-2025-59980 allows an unauthenticated, network-based attacker to gain limited read-write access to files on the device.
Is there a workaround for CVE-2025-59980?
A potential workaround for CVE-2025-59980 is to disable FTP access completely until a patch can be applied.