WID-SEC-W-2025-2238

Vulnerability from csaf_certbund - Published: 2025-10-08 22:00 - Updated: 2025-10-09 22:00
Summary
Juniper JUNOS OS, Space, OS Evolved: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
JUNOS ist das "Juniper Network Operating System", das in Juniper Appliances verwendet wird.
Angriff
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.
Betroffene Betriebssysteme
- Sonstiges - UNIX
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "JUNOS ist das \"Juniper Network Operating System\", das in Juniper Appliances verwendet wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2238 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2238.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2238 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2238"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisories vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/global-search/%40uri#sortCriteria=date%20descending\u0026f-sf_primarysourcename=Knowledge\u0026f-sf_articletype=Security%20Advisories\u0026numberOfResults=100"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103157 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Juniper-Security-Director-Insufficient-authorization-for-sensitive-resources-in-web-interface-CVE-2025-59968"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103168 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Device-allows-login-for-user-with-expired-password-CVE-2025-60010"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103165 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Specific-BGP-EVPN-update-message-causes-rpd-crash-CVE-2025-60004"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103151 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-BGP-sharding-enabled-change-in-indirect-next-hop-can-cause-RPD-crash-CVE-2025-59962"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103156 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-ACX7024-ACX7024X-ACX7100-32C-ACX7100-48L-ACX7348-ACX7509-When-specific-valid-multicast-traffic-is-received-on-the-L3-interface-a-vulnerable-device-evo-pfemand-crashes-and-restarts-CVE-2025-59967"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103163 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-Multiple-OS-command-injection-vulnerabilities-fixed-CVE-2025-60006"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103144 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-except-PTX10003-An-unauthenticated-adjacent-attacker-sending-specific-valid-traffic-can-cause-a-memory-leak-in-cfmman-leading-to-FPC-crash-and-restart-CVE-2025-52961"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103147 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-Evolved-PTX-Series-When-firewall-filter-rejects-traffic-these-packets-are-erroneously-sent-to-the-RE-CVE-2025-59958"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103146 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-EX4600-Series-and-QFX5000-Series-An-attacker-with-physical-access-can-open-a-persistent-backdoor-CVE-2025-59957"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103153 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX4700-When-forwarding-options-sampling-is-enabled-any-traffic-destined-to-the-RE-will-cause-the-forwarding-line-card-to-crash-and-restart-CVE-2025-59964"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103143 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-SRX-Series-and-MX-Series-Receipt-of-specific-SIP-packets-in-a-high-utilization-situation-causes-a-flowd-crash-CVE-2025-52960"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103167 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-When-a-user-with-the-name-ftp-or-anonymous-is-configured-unauthenticated-filesystem-access-is-allowed-CVE-2025-59980"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103170 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Arbitrary-file-download-vulnerability-in-web-interface-CVE-2025-59976"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103172 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Flooding-device-with-inbound-API-calls-leads-to-WebUI-and-CLI-management-access-DoS-CVE-2025-59975"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103171 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-Space-Reflected-client-side-HTTP-parameter-pollution-vulnerability-in-web-interface-CVE-2025-59977"
      },
      {
        "category": "external",
        "summary": "Juniper Security Advisory JSA103437 vom 2025-10-08",
        "url": "https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Security-Director-Policy-Enforcer-An-unrestricted-API-allows-a-network-based-unauthenticated-attacker-to-deploy-malicious-vSRX-images-to-VMWare-NSX-Server-CVE-2025-11198"
      }
    ],
    "source_lang": "en-US",
    "title": "Juniper JUNOS OS, Space, OS Evolved: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-10-09T22:00:00.000+00:00",
      "generator": {
        "date": "2025-10-10T08:19:57.987+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2238",
      "initial_release_date": "2025-10-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-10-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-10-09T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2025-33399, EUVD-2025-33360, EUVD-2025-33391, EUVD-2025-33397, EUVD-2025-33401, EUVD-2025-33387, EUVD-2025-33362, EUVD-2025-33363, EUVD-2025-33388, EUVD-2025-33398, EUVD-2025-33403, EUVD-2025-33378, EUVD-2025-33390, EUVD-2025-33402, EUVD-2025-33400"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Space Security Director",
                "product": {
                  "name": "Juniper JUNOS Space Security Director",
                  "product_id": "T047510",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:space_security_director"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "OS Evolved",
                "product": {
                  "name": "Juniper JUNOS OS Evolved",
                  "product_id": "T047511",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:os_evolved"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "OS",
                "product": {
                  "name": "Juniper JUNOS OS",
                  "product_id": "T047512",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:os"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Space",
                "product": {
                  "name": "Juniper JUNOS Space",
                  "product_id": "T047513",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:space"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Space Security Director Policy Enforcer",
                "product": {
                  "name": "Juniper JUNOS Space Security Director Policy Enforcer",
                  "product_id": "T047514",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:juniper:junos:space_security_director_policy_enforcer"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "JUNOS"
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11198",
      "product_status": {
        "known_affected": [
          "T047514",
          "T047510"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-11198"
    },
    {
      "cve": "CVE-2025-59968",
      "product_status": {
        "known_affected": [
          "T047514",
          "T047510"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59968"
    },
    {
      "cve": "CVE-2025-59975",
      "product_status": {
        "known_affected": [
          "T047513",
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59975"
    },
    {
      "cve": "CVE-2025-59976",
      "product_status": {
        "known_affected": [
          "T047513",
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59976"
    },
    {
      "cve": "CVE-2025-59977",
      "product_status": {
        "known_affected": [
          "T047513",
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59977"
    },
    {
      "cve": "CVE-2025-52960",
      "product_status": {
        "known_affected": [
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-52960"
    },
    {
      "cve": "CVE-2025-59957",
      "product_status": {
        "known_affected": [
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59957"
    },
    {
      "cve": "CVE-2025-59964",
      "product_status": {
        "known_affected": [
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59964"
    },
    {
      "cve": "CVE-2025-59980",
      "product_status": {
        "known_affected": [
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59980"
    },
    {
      "cve": "CVE-2025-52961",
      "product_status": {
        "known_affected": [
          "T047511"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-52961"
    },
    {
      "cve": "CVE-2025-59958",
      "product_status": {
        "known_affected": [
          "T047511"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59958"
    },
    {
      "cve": "CVE-2025-59967",
      "product_status": {
        "known_affected": [
          "T047511"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59967"
    },
    {
      "cve": "CVE-2025-60006",
      "product_status": {
        "known_affected": [
          "T047511"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-60006"
    },
    {
      "cve": "CVE-2025-59962",
      "product_status": {
        "known_affected": [
          "T047511",
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-59962"
    },
    {
      "cve": "CVE-2025-60004",
      "product_status": {
        "known_affected": [
          "T047511",
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-60004"
    },
    {
      "cve": "CVE-2025-60010",
      "product_status": {
        "known_affected": [
          "T047511",
          "T047512"
        ]
      },
      "release_date": "2025-10-08T22:00:00.000+00:00",
      "title": "CVE-2025-60010"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.