CVE-2025-21598: Juniper Junos OS Buffer Overflow Flaw

CVE-2025-21598 Overview

An Out-of-bounds Read vulnerability in Juniper Networks Junos OS and Junos OS Evolved's routing protocol daemon (rpd) allows an unauthenticated, network-based attacker to send malformed BGP packets to a device configured with packet receive trace options enabled to crash rpd. This vulnerability requires an established BGP session and can propagate across multiple Autonomous Systems (ASes), affecting both iBGP and eBGP configurations as well as IPv4 and IPv6 traffic.

Critical Impact

This vulnerability enables remote denial-of-service attacks against core network infrastructure, with the potential for cascading failures across multiple ASes as malformed BGP packets propagate through the network.

Affected Products

• Junos OS versions from 21.2R3-S8 before 21.2R3-S9, from 21.4R3-S7 before 21.4R3-S9, from 22.2R3-S4 before 22.2R3-S5, from 22.3R3-S2 before 22.3R3-S4, from 22.4R3 before 22.4R3-S5, from 23.2R2 before 23.2R2-S2, from 23.4R1 before 23.4R2-S1, from 24.2R1 before 24.2R1-S1, 24.2R2
• Junos OS Evolved versions from 21.4R3-S7-EVO before 21.4R3-S9-EVO, from 22.2R3-S4-EVO before 22.2R3-S5-EVO, from 22.3R3-S2-EVO before 22.3R3-S4-EVO, from 22.4R3-EVO before 22.4R3-S5-EVO, from 23.2R2-EVO before 23.2R2-S2-EVO, from 23.4R1-EVO before 23.4R2-S1-EVO, from 24.2R1-EVO before 24.2R1-S2-EVO, 24.2R2-EVO
• Devices with BGP packet receive trace options enabled

Discovery Timeline

• 2025-01-09 - CVE-2025-21598 published to NVD
• 2025-01-09 - Last updated in NVD database

Technical Details for CVE-2025-21598

Vulnerability Analysis

The vulnerability exists within the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. When BGP packet receive trace options are enabled on a device, the rpd process fails to properly validate the bounds of incoming BGP packet data before reading it. This Out-of-bounds Read condition (CWE-125) occurs when processing specially crafted malformed BGP packets, leading to a crash of the rpd process.

The attack requires an established BGP session with the target device, which means the attacker either needs to be a BGP peer or compromise a legitimate peer. What makes this vulnerability particularly dangerous is its propagation characteristic - malformed BGP update messages can traverse and multiply across multiple autonomous systems until they reach vulnerable devices, potentially causing widespread network disruption.

Root Cause

The root cause is an Out-of-bounds Read vulnerability (CWE-125) in the BGP packet processing logic within the rpd daemon. When packet receive trace options are enabled via the traceoptions configuration under protocols bgp, the daemon attempts to read packet data beyond the allocated buffer boundaries when processing malformed BGP attributes. This improper memory access leads to a daemon crash, resulting in a denial-of-service condition.

Attack Vector

The attack is network-based and does not require authentication, as the attacker only needs to establish a BGP session with the target or inject malformed packets through an intermediate BGP peer. The exploitation path involves:

1. Establishing or leveraging an existing BGP session with a vulnerable device
2. Sending malformed BGP update messages containing crafted attributes
3. The rpd daemon attempts to process the malformed packet with trace options enabled
4. Out-of-bounds memory read occurs, causing the rpd daemon to crash
5. The malformed packets may propagate to other ASes, potentially affecting additional vulnerable devices

The vulnerability affects devices running vulnerable versions with the BGP traceoptions configuration enabled for packet receive tracing.

Detection Methods for CVE-2025-21598

Indicators of Compromise

• Look for rpd crash messages in system logs indicating unexpected daemon termination
• Monitor for malformed BGP update messages in neighboring device logs with entries like: rpd[<pid>]: Received malformed update from <IP address> (External AS <AS#>)
• Check for rpd[<pid>]: Malformed Attribute log entries on devices within network proximity
• Repeated rpd restarts or BGP session flapping without clear network-related cause

Detection Strategies

• Implement syslog monitoring for rpd crash events and malformed BGP attribute messages across all Junos devices
• Configure SNMP traps for BGP session state changes and process crashes on critical routing infrastructure
• Deploy network monitoring to detect unusual BGP session instability patterns that may indicate propagating malformed packets
• Review BGP peer logs for patterns of malformed update messages originating from the same source AS

Monitoring Recommendations

• Enable centralized logging collection from all BGP-speaking devices to correlate malformed packet events
• Set up alerting for rpd process crashes or unexpected restarts on production routing infrastructure
• Monitor BGP session statistics for abnormal reset patterns across peering sessions
• Establish baseline BGP behavior metrics to detect anomalous activity indicative of exploitation attempts

How to Mitigate CVE-2025-21598

Immediate Actions Required

• Identify all Junos OS and Junos OS Evolved devices running affected versions with BGP traceoptions enabled
• Evaluate whether BGP packet receive trace options can be temporarily disabled on production devices to reduce attack surface
• Prioritize patching for devices in critical network paths or those with external BGP peering relationships
• Coordinate with BGP peers to identify potential sources of malformed packets in the event of an attack

Patch Information

Juniper Networks has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

Junos OS: Upgrade to 21.2R3-S9, 21.4R3-S9, 22.2R3-S5, 22.3R3-S4, 22.4R3-S5, 23.2R2-S2, 23.4R2-S1, 24.2R1-S1, or 24.2R2 or later as applicable.

Junos OS Evolved: Upgrade to 21.4R3-S9-EVO, 22.2R3-S5-EVO, 22.3R3-S4-EVO, 22.4R3-S5-EVO, 23.2R2-S2-EVO, 23.4R2-S1-EVO, 24.2R1-S2-EVO, or 24.2R2-EVO or later as applicable.

For complete patch information, refer to the Juniper Security Advisory JSA92867.

Workarounds

• Disable BGP packet receive trace options if not required for operational purposes to eliminate the vulnerable code path
• Implement strict BGP peering policies using prefix filters and peer authentication to limit exposure to untrusted sources
• Deploy network-level filtering to detect and block malformed BGP packets at network boundaries where possible
• Consider implementing BGP monitoring solutions that can detect and alert on malformed BGP attribute anomalies

# Disable BGP traceoptions to mitigate vulnerability exposure
# Review current traceoptions configuration
show configuration protocols bgp traceoptions

# Remove packet receive trace options if not operationally required
delete protocols bgp traceoptions file
delete protocols bgp traceoptions flag packet receive
commit