CVE-2025-21601 Information

Description

An Improper Following of Specification by Caller vulnerability in web management (J-Web Captive Portal 802.1X Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series EX Series MX240 MX480 MX960 QFX5120 Series allows an unauthenticated network-based attacker sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive.

Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition.

This issue affects Junos OS: 

All versions before 21.4R3-S9
from 22.2 before 22.2R3-S5
from 22.4 before 22.4R3-S4
from 23.2 before 23.2R2-S3
from 23.4 before 23.4R2-S3
from 24.2 before 24.2R1-S1 24.2R2.

An indicator of compromise is to review the CPU % of the httpd process in the CLI: e.g.   show system processes extensive | match httpd  PID nobody       52   0   20M    191M select   2   0:01   80.00% httpdhttpd ««< the percentage of httpd usage if high may be an indicator

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Reference

https://supportportal.juniper.net/JSA96452

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

7.5