CVE-2025-52985VulnerabilityPublished 11 Jul 2025Updated 18 Jul 2025

CVE-2025-52985: Juniper Networks Junos OS Evolved · Use of Incorrect Operator

Affects Juniper Networks Junos OS EvolvedSource CVE Database V5

Not known to be exploited · CVSS 5.3 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

5.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Juniper Networks Junos OS Evolved	Affected =24.4-EVO	Fixed in–

AI-suggested

To mitigate this vulnerability, European organizations should promptly identify Juniper devices running affected Junos OS Evolved versions. Network administrators must review firewall filters applied to lo0 and re:mgmt interfaces, especially those referencing prefix lists with more than 10 entries using 'from prefix-list' conditions. As a direct mitigation, reducing the size of prefix lists to 10 or fewer entries can prevent the bypass condition until patches are applied. Organizations should prioritize upgrading affected devices to the fixed versions: 23.2R2-S4-EVO or later, 23.4R2-S5-EVO or later, 24.2R2-S1-EVO or later, and 24.4R1-S3-EVO or later. In environments where immediate patching is not feasible, implementing additional access controls such as network segmentation, strict ACLs on management interfaces, and limiting exposure of re:mgmt and lo0 interfaces to trusted networks can reduce attack surface. Monitoring network traffic for anomalous packets destined to or from local device interfaces may help detect exploitation attempts. Finally, organizations should incorporate this vulnerability into their vulnerability management and incident response processes to ensure timely detection and remediation.

Description

A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a firewall filter which is applied to the lo0 or re:mgmt interface references a prefix list with 'from prefix-list', and that prefix list contains more than 10 entries, the prefix list doesn't match and packets destined to or from the local device are not filtered. This issue affects firewall filters applied to the re:mgmt interfaces as input and output, but only affects firewall filters applied to the lo0 interface as output. This issue is applicable to IPv4 and IPv6 as a prefix list can contain IPv4 and IPv6 prefixes. This issue affects Junos OS Evolved: * 23.2R2-S3-EVO versions before 23.2R2-S4-EVO, * 23.4R2-S3-EVO versions before 23.4R2-S5-EVO, * 24.2R2-EVO versions before 24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO. This issue doesn't affect Junos OS Evolved versions before 23.2R1-EVO.

Impact

For European organizations relying on Juniper Networks Junos OS Evolved in their network infrastructure, this vulnerability poses a risk of unauthorized bypass of firewall restrictions on critical routing engine interfaces. The routing engine is central to device management and control plane operations; thus, bypassing firewall filters on lo0 or re:mgmt interfaces could allow attackers to send or receive packets that should be blocked, potentially exposing management services or enabling further exploitation. This could lead to unauthorized configuration changes, interception or manipulation of routing protocols, or lateral movement within the network. Since the vulnerability affects both IPv4 and IPv6 traffic, organizations deploying dual-stack networks are equally at risk. The impact is particularly significant for service providers, large enterprises, and critical infrastructure operators in Europe that depend on Juniper devices for secure network operations. Although the vulnerability does not directly compromise confidentiality or availability, the integrity of network controls is weakened, increasing the risk of subsequent attacks. The lack of authentication requirement and network-based attack vector heighten the threat, especially in environments where management interfaces are exposed or insufficiently segmented. Given the medium severity and absence of known exploits, the immediate risk may be moderate, but the potential for exploitation in targeted attacks against European networks is notable.

References

supportportal.juniper.net/JSA100091 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2025, 20:41 UTC

WeaknessesCWE-480

Technical details

References

Community reviews

Related threats