CVE-2025-52952: Juniper Junos CFM Daemon DoS Vulnerability

CVE-2025-52952 Overview

CVE-2025-52952 is an out-of-bounds write vulnerability [CWE-787] in the Connectivity Fault Management (CFM) daemon of Juniper Networks Junos OS. The flaw affects MX Series routers equipped with MPC-BUILTIN and MPC1 through MPC9 line cards. An unauthenticated attacker on an adjacent network can send a malformed packet that causes the Flexible PIC Concentrator (FPC) to crash and restart. Continued receipt of the packet sustains the Denial of Service (DoS) condition. The CFM feature is not enabled by default, which limits the exposed attack surface to deployments that use Ethernet OAM 802.1ag.

Critical Impact
A single malformed CFM packet from an adjacent attacker can crash the FPC and, if delivered repeatedly, hold affected MX Series line cards in a sustained DoS state.

Affected Products

Juniper Junos OS: all versions before 22.2R3-S1
Juniper Junos OS: 22.4 versions before 22.4R2
MX Series routers (MX240, MX480, MX960, MX2008, MX2010, MX2020) with MPC-BUILTIN and MPC1 through MPC9 line cards

Discovery Timeline

2025-07-11 - CVE-2025-52952 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52952

Vulnerability Analysis

The defect lives in the CFM daemon, which implements IEEE 802.1ag Ethernet Operations, Administration, and Maintenance (OAM). CFM messages such as Continuity Check Messages (CCM), Loopback, and Linktrace are processed on the line-card data plane. When the daemon parses a malformed CFM Protocol Data Unit (PDU), it writes past the bounds of a fixed-size buffer. The write corrupts adjacent memory in the FPC packet-processing context and triggers a crash of the entire Flexible PIC Concentrator. The FPC then restarts, dropping all transiting traffic on the affected line card. Sustained delivery of the malformed packet produces a repeatable, long-lived outage without requiring authentication or user interaction.

Root Cause

The root cause is missing or insufficient length validation of CFM PDU fields before the daemon copies attacker-controlled bytes into a bounded buffer. Because the parser trusts embedded length or TLV values, a crafted PDU can exceed the buffer allocation and overwrite adjacent memory. The condition maps to CWE-787 (Out-of-bounds Write).

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be on a Layer 2 segment the MX device processes CFM traffic on. No credentials, tokens, or user interaction are needed. The attacker forges a malformed CFM PDU destined to the appropriate multicast MAC (01:80:C2:00:00:3x) or maintenance association, then transmits it toward an interface with CFM enabled. The daemon parses the frame, the out-of-bounds write occurs, and the FPC panics. Because the trigger is a single packet class, an attacker can loop transmission to hold the line card in a restart cycle.

No public proof-of-concept code has been published for this issue. Refer to the Juniper Support Advisory JSA100058 for vendor-verified technical details.

Detection Methods for CVE-2025-52952

Indicators of Compromise

Unexpected FPC crash and restart events in /var/log/messages or chassisd logs on MX Series devices with CFM enabled.
Repeated cfmd process faults or core files generated in /var/crash/ following the arrival of external Ethernet frames.
Traffic loss across a specific line card correlated with CFM PDU bursts observed on ingress interfaces.

Detection Strategies

Monitor Junos syslog for FPC restart, fpc offline, and cfmd core dump messages, and alert on repeated occurrences within short windows.
Capture ingress traffic on CFM-enabled interfaces and inspect for anomalous 802.1ag PDUs, including malformed TLVs and oversized length fields.
Correlate SNMP traps for FPC state changes with peer link status changes on adjacent switches to identify the source segment.

Monitoring Recommendations

Baseline normal CFM PDU rates per maintenance domain and alert on statistical deviations.
Enable Junos event-options policies to forward CHASSISD_SNMP_TRAP and fpc restart events to a centralized log collector.
Track chassis health metrics (FPC uptime, restart counts) in the NMS and treat unexplained resets on MPC1 through MPC9 as high-priority events pending patch verification.

How to Mitigate CVE-2025-52952

Immediate Actions Required

Upgrade affected MX Series devices to Junos OS 22.2R3-S1, 22.4R2, or later fixed releases identified in JSA100058.
Audit device configurations for protocols oam ethernet connectivity-fault-management and disable CFM on interfaces where it is not operationally required.
Restrict Layer 2 adjacency to trusted peers and enforce port security on access-facing interfaces that could receive attacker-crafted frames.

Patch Information

Juniper Networks has released fixed software in Junos OS 22.2R3-S1 and 22.4R2. Consult the vendor advisory JSA100058 for the complete list of fixed builds across all supported trains and for release-note guidance before upgrading production MX chassis.

Workarounds

Disable CFM (delete protocols oam ethernet connectivity-fault-management) on all interfaces where the feature is not required.
Apply firewall filters on ingress interfaces to drop 802.1ag frames (EtherType 0x8902) sourced from untrusted segments.
Segment CFM maintenance domains so that only trusted service-provider peers can deliver PDUs to affected line cards.

bash

# Configuration example: disable CFM on an interface as a temporary mitigation
configure
delete protocols oam ethernet connectivity-fault-management maintenance-domain MD-EXAMPLE \
    maintenance-association MA-EXAMPLE mep 100 interface ge-0/0/0
commit and-quit

# Verify no CFM sessions remain active on the interface
show oam ethernet connectivity-fault-management interfaces ge-0/0/0