CVE-2025-30661: Juniper Junos Privilege Escalation Flaw

CVE-2025-30661 Overview

CVE-2025-30661 is an Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in the line card script processing of Juniper Networks Junos OS. A local, low-privileged user can place a script on the router file system that the system then executes as root during boot. Successful exploitation results in privilege escalation and can grant the adversary complete control over the affected device.

The issue is restricted to specific line cards, including the MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C. Juniper documented the flaw in advisory JSA100057.

Critical Impact
A local low-privileged user can stage a script that runs as root at boot, leading to full device compromise on affected Junos OS line cards.

Affected Products

Junos OS 23.2 before 23.2R2-S4
Junos OS 23.4 before 23.4R2-S5, Junos OS 24.2 before 24.2R2-S1
Junos OS 24.4 before 24.4R1-S3 and 24.4R2, on MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C line cards

Discovery Timeline

2025-07-11 - CVE-2025-30661 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30661

Vulnerability Analysis

The vulnerability resides in how affected Junos OS line cards process scripts during initialization. Specific directories or script handlers used by the line card boot process have insecure permissions that allow non-privileged local users to write or modify files that the system later executes with root privileges. This is a classic [CWE-732] Incorrect Permission Assignment for Critical Resource issue.

Because the script runs in the trusted boot context, any commands inside it inherit root authority. An attacker can establish persistence, modify configuration, exfiltrate keys, or pivot deeper into the routing infrastructure. The issue only affects MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C line cards. Versions prior to 23.1R2 are not affected.

Root Cause

File system permissions on a critical script path used by the line card boot process are too permissive. A low-privileged local user can write to a location that is later read and executed by a root-owned process during system startup. The vulnerability requires local file system access and user interaction in the form of a system reboot to trigger script execution.

Attack Vector

Exploitation is local. An attacker who already holds a low-privileged shell on the Junos OS device copies a malicious script into the writable path consumed by the vulnerable line card initialization logic. When the device or line card next boots, the script executes as root. No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-2p66-9j7x-fmch for additional technical detail.

Detection Methods for CVE-2025-30661

Indicators of Compromise

Unexpected scripts or files appearing in line card script directories on MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, or EX9200-15C platforms.
Files in privileged script paths owned by or recently modified by non-root local accounts.
Unexplained line card reboots followed by new root-owned processes or configuration changes.

Detection Strategies

Audit file ownership and permissions on Junos OS script directories on affected line cards and flag world-writable or non-root-writable entries.
Compare running Junos OS version against the fixed releases listed in Juniper advisory JSA100057.
Correlate local shell activity, file copy operations, and subsequent reboots in syslog to identify staging followed by execution.

Monitoring Recommendations

Forward Junos OS syslog, authentication, and configuration change events to a centralized log platform for retention and analysis.
Alert on creation or modification of executable files inside line card script paths outside of vendor-approved maintenance windows.
Monitor administrative and shell access to routers, especially low-privileged accounts that should not be writing to system paths.

How to Mitigate CVE-2025-30661

Immediate Actions Required

Upgrade Junos OS to 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, 24.4R2, or later fixed releases per Juniper JSA100057.
Restrict local shell access on affected routers to trusted administrators and review existing low-privileged accounts.
Inspect line card script directories for unauthorized files prior to scheduling a reboot.

Patch Information

Juniper Networks has released fixed Junos OS versions documented in advisory JSA100057. Apply the appropriate fixed release for your train: 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, or 24.4R2. Versions prior to 23.1R2 are not affected.

Workarounds

Limit local access to the device so that only trusted administrative users can reach the file system.
Audit and tighten permissions on directories consumed by line card boot scripts where feasible until the patch is applied.
Treat reboots of affected line cards as sensitive events and verify script directory contents before each restart.

bash

# Verify Junos OS version on affected hardware
show version

# List installed line cards to confirm exposure
show chassis hardware | match "MPC10|MPC11|LC4800|LC9600|MX304-LMIC16|SRX4700|EX9200-15C"

# Restrict CLI access to trusted administrators
set system login class restricted-ops permissions [ view view-configuration ]
commit