CVE-2025-60003 is a buffer over-read vulnerability classified under CWE-126 found in the routing protocol daemon (rpd) component of Juniper Networks Junos OS and Junos OS Evolved. The flaw arises when rpd processes BGP update messages containing specific optional transitive attributes over an established BGP peering session. If one or both peers in the session are non-4-byte-AS capable—determined by the advertised capabilities during session establishment—and the device receives a maliciously crafted BGP update, the rpd process attempts to advertise this information to another peer, triggering a buffer over-read. This causes rpd to crash and subsequently restart, resulting in a denial-of-service condition that disrupts routing operations. The default Junos OS behavior supports 4-byte AS numbers, so this vulnerability is only exploitable if the disable-4byte-as configuration is enabled. Affected versions include all releases before 22.4R3-S8, 23.2 before 23.2R2-S5, 23.4 before 23.4R2-S6, 24.2 before 24.2R2-S2, and 24.4 before 24.4R2 for both Junos OS and Junos OS Evolved. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating it is remotely exploitable without authentication or user interaction, causing high impact on availability but no confidentiality or integrity loss. No known exploits have been reported in the wild to date. Network operators can verify BGP peer capabilities using the command 'show bgp neighbor <IP address> | match "4 byte AS"' to assess exposure. The vulnerability underscores the risk of legacy BGP configurations and the importance of maintaining up-to-date routing software.

For European organizations, this vulnerability poses a significant risk to network availability, particularly for ISPs, telecom providers, and large enterprises relying on Juniper routing infrastructure for BGP peering. A successful exploit can cause routing daemon crashes and restarts, leading to temporary loss of routing information, potential traffic disruption, and degraded network performance. This can impact critical services, including internet connectivity, cloud access, and inter-site communications. Organizations with legacy BGP configurations that disable 4-byte AS support are especially vulnerable. Given the importance of stable routing in telecommunications and enterprise networks across Europe, exploitation could disrupt business operations and service delivery. Although no confidentiality or integrity impact is noted, the availability impact alone can have cascading effects on dependent services and SLAs. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially as attackers may develop exploits targeting this vulnerability. The widespread use of Juniper devices in European network infrastructure increases the potential attack surface.

1. Upgrade affected Junos OS and Junos OS Evolved devices to the fixed versions: 22.4R3-S8 or later, 23.2R2-S5 or later, 23.4R2-S6 or later, 24.2R2-S2 or later, and 24.4R2 or later as applicable. 2. Audit BGP configurations to identify sessions where 4-byte AS support is disabled (disable-4byte-as enabled) and evaluate the necessity of this setting; re-enable 4-byte AS support if possible. 3. Use the command 'show bgp neighbor <IP address> | match "4 byte AS"' to verify peer capabilities and identify vulnerable sessions. 4. Implement network segmentation and filtering to restrict BGP update messages from untrusted or external peers, reducing exposure to crafted malicious updates. 5. Monitor routing daemon stability and logs for unexpected rpd crashes or restarts that may indicate exploitation attempts. 6. Employ anomaly detection systems to identify unusual BGP update patterns that could signal an attack. 7. Coordinate with upstream and downstream BGP peers to ensure consistent 4-byte AS support and secure BGP session configurations. 8. Maintain an incident response plan to quickly address routing disruptions caused by this vulnerability. These steps go beyond generic patching by focusing on configuration hygiene, proactive monitoring, and peer coordination.