Executive Summary

Informations
Name CVE-2025-21601 First vendor Publication 2025-04-09
Vendor Cve Last vendor Modification 2025-04-15

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive.

Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition.

This issue affects Junos OS:Â

* All versions before 21.4R3-S9,
* from 22.2 before 22.2R3-S5,
* from 22.4 before 22.4R3-S4,
* from 23.2 before 23.2R2-S3,
* from 23.4 before 23.4R2-S3,
* from 24.2 before 24.2R1-S1, 24.2R2.

An indicator of compromise is to review the CPU % of the httpd process in the CLI: e.g.   show system processes extensive | match httpd PID nobody    52  0  20M  191M select  2  0:01  80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21601

Sources (Detail)

https://supportportal.juniper.net/JSA96452
Source Url

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2025-05-27 02:52:08
  • First insertion