CVE-2025-52960: Juniper Junos SIP ALG DoS Vulnerability

CVE-2025-52960 Overview

CVE-2025-52960 is a Buffer Copy without Checking Size of Input vulnerability [CWE-120] in the Session Initialization Protocol (SIP) Application Layer Gateway (ALG) of Juniper Networks Junos OS. The flaw affects MX Series and SRX Series devices. An unauthenticated, network-based attacker can trigger a Denial of Service (DoS) condition by sending specific SIP packets when device memory utilization is high. The flowd or mspmand process crashes upon receiving these packets. Continuous receipt of malicious SIP packets during high utilization periods produces a sustained DoS. Because memory utilization is outside attacker control, exploitation is non-deterministic.

Critical Impact
Successful exploitation crashes the flowd/mspmand process on affected MX and SRX Series devices, disrupting traffic forwarding and firewall services until automatic recovery completes.

Affected Products

Juniper Junos OS on SRX Series: All versions before 22.4R3-S7, 23.2 before 23.2R2-S4, 23.4 before 23.4R2-S5, 24.2 before 24.2R2
Juniper Junos OS on MX Series: MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10004, MX10008
Juniper SRX Series: SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300, SRX4100, SRX4120, SRX4200, SRX4300, SRX4600, SRX4700, SRX5400, SRX5600, SRX5800

Discovery Timeline

2025-10-09 - CVE-2025-52960 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52960

Vulnerability Analysis

The vulnerability resides in the SIP ALG component of Junos OS, which inspects and rewrites SIP signaling traffic traversing MX and SRX Series devices. The SIP ALG copies data from incoming packets into internal buffers without validating the input length against the destination buffer size. When memory utilization on the device is already high, processing specific SIP packets causes the flowd (SRX Series) or mspmand (MX Series) daemon to crash. The system recovers automatically after the crash, but forwarding and firewall services are interrupted during the restart window.

Sustained DoS occurs when an attacker continuously sends the triggering SIP packets during periods of elevated memory pressure. Because attackers cannot control device memory utilization directly, exploitation is opportunistic rather than deterministic.

Root Cause

The root cause is classified under [CWE-120] Buffer Copy without Checking Size of Input, commonly referred to as a classic buffer overflow. The SIP ALG parser processes attacker-supplied SIP message fields without enforcing length bounds prior to copying them into fixed-size buffers. Combined with resource pressure during high memory utilization, the unchecked copy operation destabilizes the packet processing daemon.

Attack Vector

Exploitation requires network access to a Junos OS device with the SIP ALG enabled on the traffic path. No authentication or user interaction is required. The attacker sends crafted SIP packets to the device or through it. Because the trigger depends on device memory state, attackers cannot guarantee immediate exploitation but can sustain the DoS by maintaining a continuous stream of malicious SIP packets. Refer to the Juniper Knowledge Base Advisory for technical specifics.

Detection Methods for CVE-2025-52960

Indicators of Compromise

Unexpected crashes of the flowd process on SRX Series devices or mspmand on MX Series devices, particularly correlated with SIP traffic
Core dump files generated by flowd or mspmand after SIP packet processing
Transient loss of forwarding or firewall session state coinciding with SIP signaling activity
Elevated memory utilization warnings preceding daemon crash events

Detection Strategies

Monitor Junos system logs for flowd/mspmand restart messages using show log messages and syslog collectors
Correlate SIP ALG-inspected traffic volume with daemon crash timestamps in the security data lake
Alert on abnormal SIP signaling patterns directed at MX or SRX management or transit interfaces

Monitoring Recommendations

Track memory utilization thresholds on Junos devices to identify conditions favorable to exploitation
Ingest Junos syslog and chassis alarm data into a SIEM for correlation with SIP traffic anomalies
Baseline normal SIP call signaling volumes and rates to detect sudden spikes indicative of DoS attempts

How to Mitigate CVE-2025-52960

Immediate Actions Required

Upgrade Junos OS to a fixed release: 22.4R3-S7, 23.2R2-S4, 23.4R2-S5, 24.2R2, or later
Review whether the SIP ALG is required; disable it if not needed for the deployment
Restrict SIP traffic ingress via firewall filters where SIP inspection is not operationally necessary

Patch Information

Juniper Networks has released fixed software addressing CVE-2025-52960. Refer to the Juniper Support Portal Advisory for the complete list of fixed versions and download links. Apply the appropriate upgrade for the platform and release train in use: 22.4R3-S7, 23.2R2-S4, 23.4R2-S5, 24.2R2, or later maintenance releases.

Workarounds

Disable the SIP ALG under [edit security alg] if SIP inspection is not required in the environment
Apply firewall filters or stateful policies to drop SIP traffic (UDP/TCP port 5060) from untrusted sources
Monitor memory utilization and proactively free resources during periods of elevated usage to reduce exploitation opportunity

bash

# Configuration example - disable SIP ALG on Junos
set security alg sip disable
commit