CVE-2025-52961

A missing synchronization vulnerability in the sFlow collector handler of Junos OS Evolved on QFX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes and the sFlow thread simultaneously accesses next-hop data, the evo-pfemand process crashes, blocking traffic forwarding until automatic restart.

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to incorrect initialization, a process that should only communicate internally can be reached over the network via an open port, leading to unauthorized access to license management.

A vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact. Due to incorrect initialization, an internal process is exposed over the network via an open port.

A vulnerability in the advanced forwarding toolkit (evo-aftmand) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated network-based attacker to generate continuous routing updates, causing the evo-aftmand process on the PFE to crash, leading to a Denial-of-Service (DoS). Successful exploitation depends on a sequence of events outside the attacker's direct control.

Missing authentication for a critical function in FPCs of Junos OS Evolved on PTX series allows a local authenticated attacker with low privileges to gain direct access to FPCs as a high-privileged user, potentially leading to full compromise.

Multiple instances of an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and/or execute unauthorized commands. When an attacker executes crafted CLI commands, the options are processed via a script in some cases. These scripts are not hardened so injected commands might be executed via the shell, which allows an attacker to perform operations, which they should not be able to do according to their assigned permissions. This issue affects Junos OS Evolved: 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO. This issue does not affect Junos OS Evolved versions earlier than 24.2R1-EVO.

A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Whenever specific valid multicast traffic is received on any layer 3 interface, the evo-pfemand process crashes and restarts. Continued receipt of specific valid multicast traffic results in a sustained Denial-of-Service (DoS) attack. This issue affects Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: from 23.2R2-EVO before 23.2R2-S4-EVO, from 23.4R1-EVO before 23.4R2-EVO.

A vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability. When an output firewall filter is configured with terms where the action is 'reject', matching packets are erroneously sent to the Routing Engine (RE) and processed there, consuming RE resources. Responses from the RE may reveal confidential information about the device. This issue only applies to firewall filters on WAN or revenue interfaces, not mgmt or lo0.