CVE-2025-21601

published 2025-04-09

CVE-2025-21601: An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper…

high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA L E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU Y R A V C RE M U Amber

An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive.

Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition.

This issue affects Junos OS:

* All versions before 21.4R3-S9,
* from 22.2 before 22.2R3-S5,
* from 22.4 before 22.4R3-S4,
* from 23.2 before 23.2R2-S3,
* from 23.4 before 23.4R2-S3,
* from 24.2 before 24.2R1-S1, 24.2R2.

An indicator of compromise is to review the CPU % of the httpd process in the CLI:
e.g.
show system processes extensive | match httpd PID nobody 52 0 20M 191M select 2 0:01 80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator

Affected

18 ranges

Vendor	Product	Version range	Fixed in
juniper	ex_series	—	—
juniper	j-web	—	—
juniper	junos	<= 21.4	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	qfx_series	—	—
juniper	srx_series	—	—
juniper_networks	junos_os	< 21.4R3-S9	21.4R3-S9
juniper_networks	junos_os	>= 22.2 < 22.2R3-S5	22.2R3-S5
juniper_networks	junos_os	>= 22.4 < 22.4R3-S4	22.4R3-S4
juniper_networks	junos_os	>= 23.2 < 23.2R2-S3	23.2R2-S3
juniper_networks	junos_os	>= 23.4 < 23.4R2-S3	23.4R2-S3
juniper_networks	junos_os	>= 24.2 < 24.2R1-S1, 24.2R2	24.2R1-S1, 24.2R2

CWE-573