CVE-2025-52958 Overview
CVE-2025-52958 is a reachable assertion vulnerability [CWE-617] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent, unauthenticated attacker can trigger a Denial of Service (DoS) condition on affected devices when route validation is enabled. The flaw is exercised through a rare error-handling path during Border Gateway Protocol (BGP) initial session establishment. Repeated failures of BGP session setup cause rpd to crash and restart, and continued failures sustain the outage.
Critical Impact
Sustained crashes of the rpd process disrupt BGP routing on affected Junos OS and Junos OS Evolved devices, degrading network availability for downstream traffic.
Affected Products
- Juniper Junos OS (all versions before 22.2R3-S6; 22.4 before 22.4R3-S6; 23.2 before 23.2R2-S3; 23.4 before 23.4R2-S4; 24.2 before 24.2R2)
- Juniper Junos OS Evolved (all versions before 22.2R3-S6-EVO; 22.4 before 22.4R3-S6-EVO; 23.2 before 23.2R2-S3-EVO; 23.4 before 23.4R2-S4-EVO; 24.2 before 24.2R2-EVO)
- Devices running BGP with route validation enabled
Discovery Timeline
- 2025-07-11 - CVE-2025-52958 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52958
Vulnerability Analysis
The vulnerability resides in the rpd daemon that manages routing protocols on Junos OS and Junos OS Evolved. When route validation (RPKI-based origin validation) is active, a specific error path triggered during BGP session establishment reaches an assertion that was never expected to hold false at runtime. When the assertion fires, rpd terminates and restarts. Because the trigger recurs on subsequent BGP connection attempts, a persistent DoS is possible without authentication. The impact is limited to availability of routing services; confidentiality and integrity are not affected.
Root Cause
The defect is a reachable assertion [CWE-617] in rpd error-handling logic. During BGP session setup, when a connection request fails under a rare condition and route validation is enabled, the daemon takes a code path that violates an internal invariant. The assertion is intended to catch impossible states, but the error path allows the state to occur, causing the process to abort rather than gracefully handle the failure.
Attack Vector
Exploitation requires network adjacency and the ability to initiate BGP connection attempts toward the affected device. No credentials or user interaction are required. The attacker must repeatedly cause the failure condition during BGP session establishment. Because the target is adjacent-network reachable and the exploit path depends on a specific error scenario, exploitation complexity is elevated but does not require special privileges.
No verified public proof-of-concept is available. The vulnerability is described in prose form only; see the Juniper Security Advisory JSA100066 for vendor-supplied technical detail.
Detection Methods for CVE-2025-52958
Indicators of Compromise
- Repeated rpd process crashes and restarts logged in system messages, particularly correlated with BGP peer session establishment attempts.
- BGP session flaps involving peers configured with route validation, without a corresponding change in peer configuration or link state.
- Core files generated by rpd on devices running affected Junos OS or Junos OS Evolved versions.
Detection Strategies
- Monitor Junos syslog for messages such as RPD_TASK_REINIT, rpd core, and BGP state transitions to Idle shortly after OpenSent or OpenConfirm.
- Correlate rpd restarts with inbound BGP connection attempts from peers where RPKI route validation is enforced.
- Alert on unexplained routing table churn tied to a single BGP neighbor repeatedly initiating sessions.
Monitoring Recommendations
- Forward Junos syslog and BGP state telemetry to a centralized log platform for correlation across routers.
- Track rpd uptime and restart counts as a health metric; sudden decreases indicate crash loops.
- Baseline BGP session establishment behavior for validated peers so that anomalous connection attempts stand out.
How to Mitigate CVE-2025-52958
Immediate Actions Required
- Inventory all Junos OS and Junos OS Evolved devices and identify those running affected releases with route validation enabled.
- Prioritize upgrades on devices exposed to external BGP peers, especially internet-facing edge routers.
- Review BGP peer configurations to ensure only trusted, authenticated neighbors can initiate sessions.
Patch Information
Juniper has released fixed software in Junos OS 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R2, and later, and in the corresponding Junos OS Evolved releases (22.2R3-S6-EVO, 22.4R3-S6-EVO, 23.2R2-S3-EVO, 23.4R2-S4-EVO, 24.2R2-EVO). Upgrade to a fixed release as documented in the Juniper Security Advisory JSA100066.
Workarounds
- Where operationally feasible, disable RPKI-based route validation until a fixed release is deployed, accepting the trade-off in origin validation coverage.
- Restrict BGP session establishment to known, trusted peer IP addresses using firewall filters and control-plane policing.
- Apply BGP authentication and TCP-AO or MD5 protections to reduce the pool of endpoints able to initiate sessions against affected routers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
