CVE-2025-30661 is a high-severity vulnerability affecting Juniper Networks Junos OS, specifically related to incorrect permission assignment for critical resources in the line card script processing functionality. The vulnerability allows a local, low-privileged user with access to the local file system on affected devices to place scripts that will be executed with root privileges during system boot. This improper permission configuration enables privilege escalation, potentially granting the attacker full control over the affected system. The vulnerability impacts specific line cards including MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C, across Junos OS versions 23.2 before 23.2R2-S4, 23.4 before 23.4R2-S5, 24.2 before 24.2R2-S1, and 24.4 before 24.4R1-S3 and 24.4R2. Versions prior to 23.1R2 are not affected. The CVSS v3.1 score is 7.3, indicating high severity, with the vector reflecting local attack vector, low attack complexity, low privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. While no known exploits are currently reported in the wild, the vulnerability poses a significant risk due to the potential for complete system compromise via privilege escalation. The root cause is CWE-732, which involves incorrect permission assignment for critical resources, leading to unauthorized access or execution. This vulnerability is particularly critical for network infrastructure devices that rely on Junos OS line cards, as compromise could disrupt network operations or allow attackers to manipulate network traffic or configurations.

For European organizations, the impact of this vulnerability could be substantial, especially for those relying on Juniper Networks infrastructure in critical network environments such as ISPs, telecommunications providers, data centers, and large enterprises. Successful exploitation could lead to full system compromise of affected routers or security devices, resulting in unauthorized access to sensitive network configurations, interception or manipulation of network traffic, and potential disruption of network availability. This could affect confidentiality, integrity, and availability of network services, leading to operational downtime, data breaches, and reputational damage. Given the critical role of network infrastructure in supporting business operations and regulatory compliance (e.g., GDPR), exploitation could also result in legal and financial consequences. The requirement for local access and user interaction somewhat limits remote exploitation but insider threats or attackers with initial footholds could leverage this vulnerability to escalate privileges and move laterally within networks. The affected line cards are commonly deployed in high-performance routing and security appliances, making the vulnerability relevant for organizations with advanced network setups.

To mitigate this vulnerability, European organizations should: 1) Immediately identify and inventory Juniper devices using the affected line cards and Junos OS versions. 2) Apply the latest Juniper patches and updates as soon as they become available, specifically upgrading to versions 23.2R2-S4 or later, 23.4R2-S5 or later, 24.2R2-S1 or later, and 24.4R1-S3 or later, as applicable. 3) Restrict local file system access on affected devices to trusted administrators only, employing strict access controls and monitoring for unauthorized file modifications. 4) Implement robust logging and alerting on file system changes and script executions on network devices to detect suspicious activity early. 5) Conduct regular audits of device configurations and permissions to ensure no unauthorized scripts or files are present. 6) Employ network segmentation and zero-trust principles to limit the ability of attackers to gain local access to critical infrastructure devices. 7) Train network administrators on secure operational practices and the risks of local privilege escalation vulnerabilities. 8) Consider deploying host-based intrusion detection systems (HIDS) or endpoint detection and response (EDR) solutions where feasible on network devices to detect anomalous behavior. These steps go beyond generic patching advice by emphasizing access control, monitoring, and operational security tailored to the specific nature of this vulnerability.