CVE-2025-52983

published 2025-07-11

CVE-2025-52983: A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker…

Priority P3 50 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

A UI Discrepancy for Security Feature

vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device.

On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root.
This issue affects Junos OS:

* all versions before 22.2R3-S7,
* 22.4 versions before 22.4R3-S5,
* 23.2 versions before 23.2R2-S3,
* 23.4 versions before 23.4R2-S3,
* 24.2 versions before 24.2R1-S2, 24.2R2.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
juniper	junos	< 22.2	22.2
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper_networks	junos_os	< 22.2R3-S7	22.2R3-S7
juniper_networks	junos_os	>= 22.4 < 22.4R3-S5	22.4R3-S5
juniper_networks	junos_os	>= 23.2 < 23.2R2-S3	23.2R2-S3
juniper_networks	junos_os	>= 23.4 < 23.4R2-S3	23.4R2-S3
juniper_networks	junos_os	>= 24.2 < 24.2R1-S2, 24.2R2	24.2R1-S2, 24.2R2

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 8.6 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-446