CVE-2025-59980

published 2025-10-09

CVE-2025-59980: An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited…

medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU Y R X V X RE M U X

An Authentication Bypass by Primary Weakness

in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device.
When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory.

This issue affects Junos OS:

* all versions before 22.4R3-S8,
* 23.2 versions before 23.2R2-S3,
* 23.4 versions before 23.4R2.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
juniper	junos	< 22.4	22.4
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper_networks	junos_os	< 22.4R3-S8	22.4R3-S8
juniper_networks	junos_os	>= 23.2 < 23.2R2-S3	23.2R2-S3
juniper_networks	junos_os	>= 23.4 < 23.4R2	23.4R2

CWE-305