CVE-2025-52954: Junos OS Evolved Privilege Escalation Flaw

CVE-2025-52954 Overview

CVE-2025-52954 is a Missing Authorization vulnerability [CWE-862] in the internal virtual routing and forwarding (VRF) of Juniper Networks Junos OS Evolved. A local, low-privileged user with the ability to send packets over the internal VRF can execute arbitrary Junos commands and modify the device configuration. Successful exploitation results in root-level system compromise of the affected routing platform.

The flaw affects multiple release trains of Junos OS Evolved, including 22.2, 22.4, 23.2, 23.4, 24.2, and 24.4. Juniper has published advisory JSA100060 with fixed versions for each supported branch.

Critical Impact
Any authenticated low-privileged user on an affected Junos OS Evolved device can escalate to root and gain full control over the router, including arbitrary configuration changes and command execution.

Affected Products

Juniper Junos OS Evolved: all versions before 22.2R3-S7-EVO
Juniper Junos OS Evolved: 22.4 before 22.4R3-S7-EVO, 23.2 before 23.2R2-S4-EVO, 23.4 before 23.4R2-S5-EVO
Juniper Junos OS Evolved: 24.2 before 24.2R2-S1-EVO, 24.4 before 24.4R1-S2-EVO and 24.4R2-EVO

Discovery Timeline

2025-07-11 - CVE-2025-52954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52954

Vulnerability Analysis

Junos OS Evolved uses an internal virtual routing and forwarding (VRF) instance to carry control-plane traffic between components of the distributed operating system. This internal VRF is expected to be reachable only by trusted system processes. The vulnerability stems from missing authorization checks on messages received over that internal VRF.

Because the operating system does not validate the identity or privilege level of senders on the internal VRF, any local user able to place packets onto that interface is treated as a trusted internal component. This allows the user to inject Junos management commands and configuration changes that are executed with root privileges.

The result is a full authorization bypass leading to local privilege escalation. An attacker with shell access at a low privilege level, such as an unprivileged operator or a constrained login class, can obtain root and pivot to full device compromise.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862] on the internal VRF communication path. The management plane trusts messages arriving on the internal VRF without verifying that the originator holds the required privileges to execute the requested Junos commands or configuration mutations.

Attack Vector

Exploitation requires local access with low privileges (PR:L) and no user interaction. The attacker crafts packets destined for services listening on the internal VRF and issues commands that the system executes as root. No memory corruption or complex chain is required; the attack abuses the intended command interface exposed on an insufficiently protected VRF.

No public proof-of-concept exploit or in-the-wild exploitation has been reported. Refer to the Juniper Security Advisory JSA100060 for vendor technical details.

Detection Methods for CVE-2025-52954

Indicators of Compromise

Unexpected configuration commits or rollback events originating from non-administrative users in Junos audit logs.
Junos CLI command executions attributed to low-privileged accounts that should not have configuration authority.
Local user processes generating traffic bound to the internal VRF interface.

Detection Strategies

Review Junos messages, interactive-commands, and authorization logs for commit or command events by non-privileged users.
Correlate shell login sessions of low-privileged accounts with subsequent root-level configuration changes.
Baseline expected internal VRF traffic and alert on packet sources originating from user shells.

Monitoring Recommendations

Forward Junos syslog and audit trails to a centralized SIEM or data lake and retain them for forensic review.
Alert on new or unexpected local user accounts and on changes to login class permissions on Junos OS Evolved devices.
Monitor administrative sessions for out-of-band command patterns that deviate from documented change windows.

How to Mitigate CVE-2025-52954

Immediate Actions Required

Upgrade Junos OS Evolved to a fixed release: 22.2R3-S7-EVO, 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S2-EVO, or later per JSA100060.
Audit all local user accounts on affected devices and remove unused or unnecessary low-privileged logins.
Restrict shell access on Junos OS Evolved to a minimal set of trusted administrators.

Patch Information

Juniper Networks released fixed builds addressing CVE-2025-52954 across all supported Junos OS Evolved release trains. The authoritative fix matrix and download links are provided in the Juniper Security Advisory JSA100060. Operators should schedule upgrades on any device running an affected version listed in the advisory.

Workarounds

No vendor-supplied workaround eliminates the flaw; upgrading to a fixed release is the only complete remediation per Juniper's advisory.
Reduce exposure by strictly limiting local login access and enforcing the principle of least privilege on Junos OS Evolved login classes.
Restrict physical and management-network access to the device so that only trusted operators can obtain a local shell.

bash

# Verify running version and review local user accounts on Junos OS Evolved
show version
show configuration system login | display set
# After upgrade, confirm fixed release is installed
show system software