Vulnerability-Lookup

FKIE_CVE-2025-30649

Vulnerability from fkie_nvd - Published: 2025-04-09 20:15 - Updated: 2026-06-17 09:09

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send specific spoofed packets to cause a CPU Denial of Service (DoS) to the MX-SPC3 SPUs. Continued receipt and processing of these specific packets will sustain the DoS condition. This issue affects Junos OS: * All versions before 22.2R3-S6, * from 22.4 before 22.4R3-S4, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R1-S2, 24.2R2 An indicator of compromise will indicate the SPC3 SPUs utilization has spiked. For example: user@device> show services service-sets summary Service sets CPU Interface configured Bytes used Session bytes used Policy bytes used utilization "interface" 1 "bytes" (percent%) "sessions" ("percent"%) "bytes" ("percent"%) 99.97 % OVLD <<<<<< look for high CPU usage

References

	URL	Tags
	sirt@juniper.net	https://supportportal.juniper.net/JSA96459	Vendor Advisory

Impacted products

Vendor	Product	Version
juniper	junos	*
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.2
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	22.4
juniper	junos	23.2
juniper	junos	23.2
juniper	junos	23.2
juniper	junos	23.2
juniper	junos	23.2
juniper	junos	23.2
juniper	junos	23.2
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	23.4
juniper	junos	24.2
juniper	junos	24.2
juniper	junos	24.2
juniper	junos	24.2
juniper	mx-spc3	-
juniper	mx240	-
juniper	mx480	-
juniper	mx960	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "syslog stream with TCP transport enabled"
          ],
          "platforms": [
            "MX240",
            "MX480",
            "MX960",
            "with SPC3"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "22.2R3-S6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-S4",
              "status": "affected",
              "version": "22.4",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-S3",
              "status": "affected",
              "version": "23.2",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S4",
              "status": "affected",
              "version": "23.4",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R1-S2, 24.2R2",
              "status": "affected",
              "version": "24.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "92CA998E-CCA2-4629-ABAC-20F9C5E209CB",
              "versionEndExcluding": "22.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "06156CD6-09D3-4A05-9C5E-BC64A70640F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "E949B21B-AD62-4022-9088-06313277479E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "8D862E6F-0D01-4B25-8340-888C30F75A2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "2F28F73E-8563-41B9-A313-BBAAD5B57A67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "E37D4694-C80B-475E-AB5B-BB431F59C5E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "5EC0D2D2-4922-4675-8A2C-57A08D7BE334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "9EC91F9D-DEDA-46B4-A39F-59A2CDB86C2E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*",
              "matchCriteriaId": "591AA3E6-62A2-4A1A-A04C-E808F71D8B6E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*",
              "matchCriteriaId": "786F993E-32CB-492A-A7CC-A7E4F48EA8B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*",
              "matchCriteriaId": "60CEA89D-BAC4-41CD-A1D1-AA5EDDEBD54A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r3-s3:*:*:*:*:*:*",
              "matchCriteriaId": "BC449CC7-B2D6-41CB-8D6C-81DE89E79520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r3-s4:*:*:*:*:*:*",
              "matchCriteriaId": "05E47861-3311-45E2-A722-8CD7FFDC2DFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.2:r3-s5:*:*:*:*:*:*",
              "matchCriteriaId": "748EAB0A-6B22-4098-8735-CC76BEAA9BB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "1379EF30-AF04-4F98-8328-52A631F24737",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*",
              "matchCriteriaId": "28E42A41-7965-456B-B0AF-9D3229CE4D4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "CB1A77D6-D3AD-481B-979C-8F778530B175",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "3A064B6B-A99B-4D8D-A62D-B00C7870BC30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*",
              "matchCriteriaId": "40813417-A938-4F74-A419-8C5188A35486",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "7FC1BA1A-DF0E-4B15-86BA-24C60E546732",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "EBB967BF-3495-476D-839A-9DBFCBE69F91",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*",
              "matchCriteriaId": "7E5688D6-DCA4-4550-9CD1-A3D792252129",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*",
              "matchCriteriaId": "8494546C-00EA-49B6-B6FA-FDE42CA5B1FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:*",
              "matchCriteriaId": "8BB98579-FA33-4E41-A162-A46E9709FBD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:*",
              "matchCriteriaId": "08E2562F-FB18-4347-8497-7D61B8157EBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "1ADA814B-EF98-45B1-AF7A-0C89688F7CA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "A6FB32DF-D062-4FB9-8777-452978BEC7B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "B3B6C811-5C10-4486-849D-5559B592350A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*",
              "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "CB2D1FCE-8019-4CE1-BA45-D62F91AF7B51",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*",
              "matchCriteriaId": "175CCB13-76C0-44A4-A71D-41E22B92EB23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*",
              "matchCriteriaId": "166BFDB3-1945-4949-BC2B-E18442FF2E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*",
              "matchCriteriaId": "5923610F-878C-48CA-8B5D-9C609E4DD4DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:*",
              "matchCriteriaId": "A7C207E3-0252-4192-8E8C-E2ED2831B4F4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "89524D6D-0B22-4952-AD8E-8072C5A05D5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "AD69A194-1B03-44EA-8092-79BD10C6F729",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "8463ADB4-B8A7-4D63-97A9-232ED713A21C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "266B520A-482A-43F7-90F8-B9D64D30034F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:mx-spc3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "08870BF6-F53C-4669-9BB5-EB0691B4EF7B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4A26704-A6A4-4C4F-9E12-A0A0259491EF",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "104858BD-D31D-40E0-8524-2EC311F10EAC",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5E08E1E-0FE4-4294-9497-BBFFECA2A220",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Input Validation vulnerability in the\u00a0syslog stream TCP transport\u00a0of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send specific spoofed packets to cause a CPU Denial of Service (DoS) to the MX-SPC3 SPUs.\n\nContinued receipt and processing of these specific packets will sustain the DoS condition.\n\nThis issue affects Junos OS:  *  All versions before 22.2R3-S6,\n  *  from 22.4 before 22.4R3-S4,\n  *  from 23.2 before 23.2R2-S3,\n  *  from 23.4 before 23.4R2-S4,\n  *  from 24.2 before 24.2R1-S2, 24.2R2\n\n\nAn indicator of compromise will indicate the SPC3 SPUs utilization has spiked.\n\n\nFor example:\u00a0\n\u00a0 \u00a0user@device\u003e show services service-sets summary\n                     Service sets                                                                               CPU\n  Interface          configured       Bytes used             Session bytes used        Policy bytes used        utilization\n  \"interface\"          1              \"bytes\" (percent%)     \"sessions\" (\"percent\"%)   \"bytes\" (\"percent\"%)     99.97 % OVLD  \u003c\u003c\u003c\u003c\u003c\u003c look for high CPU usage"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de validaci\u00f3n de entrada incorrecta en el transporte TCP del flujo de syslog de Juniper Networks Junos OS en dispositivos MX240, MX480 y MX960 con tarjeta de servicios de seguridad MX-SPC3 permite que un atacante no autenticado, basado en la red, env\u00ede paquetes falsificados espec\u00edficos para provocar una denegaci\u00f3n de servicio (DoS) de la CPU a las SPU MX-SPC3. La recepci\u00f3n y el procesamiento continuos de estos paquetes mantendr\u00e1n la condici\u00f3n de DoS. Este problema afecta a Junos OS: * Todas las versiones anteriores a 22.2R3-S6, * de 22.4 a 22.4R3-S4, * de 23.2 a 23.2R2-S3, * de 23.4 a 23.4R2-S4, * de 24.2 a 24.2R1-S2, 24.2R2. Un indicador de compromiso indicar\u00e1 un aumento repentino en la utilizaci\u00f3n de las SPU SPC3. Por ejemplo: usuario@dispositivo\u0026gt; mostrar servicios resumen de conjuntos de servicios Conjuntos de servicios CPU Interfaz configurada Bytes utilizados Bytes de sesi\u00f3n utilizados Bytes de pol\u00edtica utilizados utilizaci\u00f3n \"interfaz\" 1 \"bytes\" (porcentaje%) \"sesiones\" (\"porcentaje\"%) \"bytes\" (\"porcentaje\"%) 99,97 % OVLD \u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt; buscar alto uso de CPU"
    }
  ],
  "id": "CVE-2025-30649",
  "lastModified": "2026-06-17T09:09:06.150",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "USER",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "AMBER",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Amber",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "MODERATE"
        },
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-30649",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-09T20:02:41.255699Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-04-09T20:15:28.490",
  "references": [
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://supportportal.juniper.net/JSA96459"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "sirt@juniper.net",
      "type": "Secondary"
    }
  ]
}

CVE-2025-30649 (GCVE-0-2025-30649)

Vulnerability from cvelistv5 – Published: 2025-04-09 19:55 – Updated: 2025-04-09 20:03

Title

Junos OS: MX240, MX480, MX960 with SPC3: An attacker sending specific packets will cause a CPU utilization DoS.

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/V:C/RE:M/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-09 20:02 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

juniper CNA under the mitre root

CNA scorecard B 85/100 over 175 records in the last 180 days details

References

1 reference

URL	Tags
https://supportportal.juniper.net/JSA96459	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Juniper Networks	Junos OS	Affected: 0 , < 22.2R3-S6 (semver) Affected: 22.4 , < 22.4R3-S4 (semver) Affected: 23.2 , < 23.2R2-S3 (semver) Affected: 23.4 , < 23.4R2-S4 (semver) Affected: 24.2 , < 24.2R1-S2, 24.2R2 (semver)

Date Public

2025-04-09 16:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-09T20:02:41.255699Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-09T20:03:04.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "syslog stream with TCP transport enabled"
          ],
          "platforms": [
            "MX240",
            "MX480",
            "MX960",
            "with SPC3"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "22.2R3-S6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "22.4R3-S4",
              "status": "affected",
              "version": "22.4",
              "versionType": "semver"
            },
            {
              "lessThan": "23.2R2-S3",
              "status": "affected",
              "version": "23.2",
              "versionType": "semver"
            },
            {
              "lessThan": "23.4R2-S4",
              "status": "affected",
              "version": "23.4",
              "versionType": "semver"
            },
            {
              "lessThan": "24.2R1-S2, 24.2R2",
              "status": "affected",
              "version": "24.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u0026nbsp; [services service-set \"service-set-name\" syslog stream \"stream-name\" host \"syslog-server-ip-address-or-hostname\"]\u003cbr\u003e\u0026nbsp; [services service-set \"service-set-name\" syslog stream \"stream-name\" host port \"syslog-server-port\"]\u003cbr\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp; [services service-set \"service-set-name\" syslog stream \"stream-name\" transport protocol tcp]\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp; [services service-set \"service-set-name\" syslog stream \"stream-name\" source-address \"syslog-collector-ip-address\"]\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "[services service-set \"service-set-name\" syslog stream \"stream-name\" host \"syslog-server-ip-address-or-hostname\"]\n\u00a0 [services service-set \"service-set-name\" syslog stream \"stream-name\" host port \"syslog-server-port\"]\n\u00a0 [services service-set \"service-set-name\" syslog stream \"stream-name\" transport protocol tcp]\n\u00a0 [services service-set \"service-set-name\" syslog stream \"stream-name\" source-address \"syslog-collector-ip-address\"]"
        }
      ],
      "datePublic": "2025-04-09T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Improper Input Validation vulnerability in the\u0026nbsp;syslog stream TCP transport\u0026nbsp;of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send specific spoofed packets to cause a CPU Denial of Service (DoS) to the MX-SPC3 SPUs.\u003cbr\u003e\u003cbr\u003eContinued receipt and processing of these specific packets will sustain the DoS condition.\u003cbr\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cbr\u003eThis issue affects Junos OS:\u003c/span\u003e\u003cul\u003e\u003cli\u003eAll versions before 22.2R3-S6,\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3-S4,\u003c/li\u003e\u003cli\u003efrom 23.2 before 23.2R2-S3,\u003c/li\u003e\u003cli\u003efrom 23.4 before 23.4R2-S4,\u003c/li\u003e\u003cli\u003efrom 24.2 before 24.2R1-S2, 24.2R2\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003eAn indicator of compromise will indicate the SPC3 SPUs utilization has spiked.\u003c/div\u003e\u003cbr\u003eFor example:\u0026nbsp;\u003cbr\u003e\u0026nbsp; \u0026nbsp;user@device\u0026gt; show services service-sets summary\u003cbr\u003e\u003cdiv\u003e\u003cpre\u003e                     Service sets                                                                               CPU\n  Interface          configured       Bytes used             Session bytes used        Policy bytes used        utilization\n  \"interface\"          1              \"bytes\" (percent%)     \"sessions\" (\"percent\"%)   \"bytes\" (\"percent\"%)     99.97 % OVLD  \u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt; look for high CPU usage\n\u003c/pre\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "An Improper Input Validation vulnerability in the\u00a0syslog stream TCP transport\u00a0of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Security Services Card allows an unauthenticated, network-based attacker, to send specific spoofed packets to cause a CPU Denial of Service (DoS) to the MX-SPC3 SPUs.\n\nContinued receipt and processing of these specific packets will sustain the DoS condition.\n\nThis issue affects Junos OS:  *  All versions before 22.2R3-S6,\n  *  from 22.4 before 22.4R3-S4,\n  *  from 23.2 before 23.2R2-S3,\n  *  from 23.4 before 23.4R2-S4,\n  *  from 24.2 before 24.2R1-S2, 24.2R2\n\n\nAn indicator of compromise will indicate the SPC3 SPUs utilization has spiked.\n\n\nFor example:\u00a0\n\u00a0 \u00a0user@device\u003e show services service-sets summary\n                     Service sets                                                                               CPU\n  Interface          configured       Bytes used             Session bytes used        Policy bytes used        utilization\n  \"interface\"          1              \"bytes\" (percent%)     \"sessions\" (\"percent\"%)   \"bytes\" (\"percent\"%)     99.97 % OVLD  \u003c\u003c\u003c\u003c\u003c\u003c look for high CPU usage"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/V:C/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-09T19:55:37.363Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA96459"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue: Junos OS: 22.2R3-S6, 22.4R3-S4, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases.\u003cbr\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue: Junos OS: 22.2R3-S6, 22.4R3-S4, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, 24.4R1, and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA96459",
        "defect": [
          "1823932"
        ],
        "discovery": "USER"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-04-09T16:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Junos OS: MX240, MX480, MX960 with SPC3: An attacker sending specific packets will cause a CPU utilization DoS.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds for this issue."
            }
          ],
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2025-30649",
    "datePublished": "2025-04-09T19:55:37.363Z",
    "dateReserved": "2025-03-24T19:34:11.321Z",
    "dateUpdated": "2025-04-09T20:03:04.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted