CVE-2025-30657: Juniper Junos SRRD DoS Vulnerability

CVE-2025-30657 Overview

CVE-2025-30657 is an Improper Encoding or Escaping of Output vulnerability [CWE-116] in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS. An unauthenticated, network-based attacker can trigger a Denial-of-Service (DoS) condition by sending a specific BGP update message to a device configured for flow-monitoring. The routing protocol daemon (rpd) processes the message correctly, but when the data is forwarded to SRRD it is encoded incorrectly, causing SRRD to crash. This produces a momentary interruption of jflow processing until the daemon automatically restarts. Traffic forwarding itself is not affected. The issue impacts Junos OS but does not affect Junos OS Evolved.

Critical Impact
A single crafted BGP update message can crash the SRRD daemon on flow-monitoring-enabled Junos OS devices, disrupting jflow telemetry collection used for network visibility, security monitoring, and billing.

Affected Products

Juniper Junos OS: all versions before 21.2R3-S9
Juniper Junos OS: 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6
Juniper Junos OS: 22.4 versions before 22.4R3, 23.2 versions before 23.2R1-S2 and 23.2R2

Discovery Timeline

2025-04-09 - CVE-2025-30657 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30657

Vulnerability Analysis

The vulnerability resides in how SRRD handles data forwarded from the routing protocol daemon rpd. When a Junos OS device configured for flow-monitoring receives a specific BGP update message, rpd parses and processes the message correctly. The failure occurs at the boundary between rpd and SRRD, where the data is improperly encoded before being handed off. SRRD receives malformed input it cannot parse safely and crashes. Junos automatically restarts SRRD, but jflow record processing halts during the outage window. Repeated exploitation can sustain the DoS by causing repeated crashes and restart cycles, degrading NetFlow/jflow-based visibility.

Root Cause

The root cause is classified as CWE-116, Improper Encoding or Escaping of Output. The data serialization path between rpd and SRRD does not correctly encode all fields present in certain BGP update messages. When SRRD deserializes the improperly encoded payload, it enters an unexpected state that triggers a crash. The pre-conditions require the device to be configured for flow-monitoring, so devices without jflow/sampling configured are not affected.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker who can inject a specific BGP update into the routing table of a vulnerable device, whether directly as a BGP peer or indirectly via a compromised upstream, can trigger the crash. Because the trigger travels through normal BGP UPDATE propagation, exposure extends beyond direct peers. The vulnerability affects availability of the SRRD service only. Confidentiality and integrity of forwarded traffic are unaffected.

No verified public exploit code is available. Refer to the Juniper Security Advisory JSA96467 for authoritative technical details.

Detection Methods for CVE-2025-30657

Indicators of Compromise

Unexpected SRRD daemon crashes or restarts logged in Junos system messages, often accompanied by core files under /var/crash/ or /var/tmp/.
Gaps or sudden termination of jflow/NetFlow record export from routers configured for flow-monitoring.
rpd-to-SRRD IPC errors appearing in messages logs around the time of BGP UPDATE receipt.

Detection Strategies

Correlate BGP UPDATE receipt timestamps with SRRD process restart events to identify externally triggered crashes.
Monitor Junos daemons via SNMP or Junos Telemetry Interface for repeated SRRD PID changes.
Ingest Junos syslog into a centralized SIEM and alert on SRRD crash strings, core dump generation, or repeated daemon respawning messages.

Monitoring Recommendations

Baseline jflow export volume from each flow-monitoring router and alert on unexpected drops.
Enable Junos event-options policies to notify on SRRD termination and generate a support case automatically.
Track BGP UPDATE anomalies from peers, particularly malformed or unusual attribute combinations, using BGP monitoring tools such as BMP collectors.

How to Mitigate CVE-2025-30657

Immediate Actions Required

Inventory all Junos OS devices configured with flow-monitoring or jflow sampling and confirm running versions against the fixed release list.
Schedule upgrades to fixed Junos OS releases on affected devices, prioritizing internet-facing BGP routers.
Restrict BGP peering to authenticated, trusted neighbors and apply strict inbound BGP import policies to filter malformed updates where possible.

Patch Information

Juniper Networks has released fixed software in Junos OS 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3, 23.2R1-S2, 23.2R2, and all subsequent releases. Full remediation guidance is available in the Juniper Security Advisory JSA96467. Junos OS Evolved is not affected and requires no action for this CVE.

Workarounds

Where upgrade is not immediately feasible, disable flow-monitoring or jflow sampling on affected devices to remove the vulnerable code path.
Apply BGP import policies that reject or normalize update messages containing unusual attribute combinations from untrusted peers.
Use BGP session authentication (TCP-AO or MD5) and prefix limits to reduce exposure to unauthorized or malformed updates.

bash

# Example: verify running Junos version and check for flow-monitoring configuration
show version | match Junos
show configuration forwarding-options sampling
show configuration services flow-monitoring