CVE-2025-52982 Overview
CVE-2025-52982 is an Improper Resource Shutdown or Release vulnerability [CWE-404] in the Session Initiation Protocol Application Layer Gateway (SIP ALG) of Juniper Networks Junos OS on MX Series devices equipped with the Multiservices Modular PIC Concentrator (MS-MPC). An unauthenticated, network-based attacker can trigger a Denial-of-Service (DoS) condition by sending a specific sequence of SIP call events. The condition requires two or more service sets configured to process SIP calls concurrently. Successful exploitation crashes and restarts the MS-MPC, disrupting subscriber services routed through the affected line card.
Critical Impact
Unauthenticated remote attackers can crash the MS-MPC on MX Series routers processing SIP traffic, interrupting service continuity for all sessions handled by the card.
Affected Products
- Juniper Junos OS on MX Series (MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10004, MX10008) with MS-MPC
- Junos OS versions before 21.2R3-S9, 21.4 from 21.4R1, 22.2 before 22.2R3-S6, and 22.4 before 22.4R3-S6
- MS-MPC service card processing SIP ALG traffic across multiple service sets
Discovery Timeline
- 2025-07-11 - CVE-2025-52982 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52982
Vulnerability Analysis
The vulnerability resides in the SIP ALG component running on the MS-MPC service card. SIP ALGs inspect and rewrite SIP signaling messages traversing the router, tracking call state to support Network Address Translation and firewall pinholing. When the MX Series device is configured with two or more service sets each processing SIP calls, a specific ordered sequence of call events causes the ALG to release or shut down a resource incorrectly. The resulting fault crashes the MS-MPC process and forces the card to restart, which drops in-flight sessions and interrupts traffic forwarding.
The issue is scoped to the MS-MPC hardware and its associated software stack. MX-SPC3 service cards and SRX Series firewalls do not share the vulnerable code path. Because MS-MPC reached End of Life after Junos OS 22.4, releases beyond 22.4 are not affected.
Root Cause
The defect is classified under [CWE-404] Improper Resource Shutdown or Release. State tracking for SIP calls across multiple service sets fails to correctly release call-associated resources under the specific event sequence, corrupting internal state and causing the service daemon on the MS-MPC to terminate.
Attack Vector
An unauthenticated attacker on the network sends SIP traffic that traverses the affected MX Series device. By generating the specific sequence of SIP call events across service sets configured to handle SIP, the attacker triggers the crash. No authentication or user interaction is required. Because SIP typically traverses provider edges and enterprise perimeters, the attack surface is exposed wherever SIP calls transit the affected MS-MPC.
See the Juniper Security Advisory JSA100088 for full technical details.
Detection Methods for CVE-2025-52982
Indicators of Compromise
- Unexpected MS-MPC crash and restart events recorded in /var/log/messages or chassisd logs on MX Series devices
- SIP ALG process (mspmand or related service daemon) coredumps present on the MS-MPC
- Interruption of SIP call flows correlated with elevated inbound SIP signaling from a small set of sources
Detection Strategies
- Monitor Junos syslog for MSPMAND and CHASSISD crash, restart, and coredump messages tied to service sets processing SIP
- Correlate MS-MPC restart events with SIP INVITE, BYE, and CANCEL traffic patterns to identify anomalous call sequences
- Baseline SIP call volume per service set and alert on abrupt bursts or malformed call-state transitions
Monitoring Recommendations
- Forward Junos OS syslog and SNMP traps to a centralized logging platform for chassis and PIC state changes
- Enable flow telemetry on interfaces feeding MS-MPC service sets to retain SIP signaling for post-incident review
- Track service set health counters using show services service-sets summary and alert on repeated resets
How to Mitigate CVE-2025-52982
Immediate Actions Required
- Upgrade Junos OS to a fixed release: 21.2R3-S9, 22.2R3-S6, 22.4R3-S6, or later per the vendor advisory
- Inventory MX Series chassis to identify MS-MPC cards processing SIP traffic across multiple service sets
- Restrict SIP traffic reaching affected devices to trusted peers using firewall filters where feasible
Patch Information
Juniper Networks has released fixed software addressing this issue. Refer to Juniper Security Advisory JSA100088 for the complete list of fixed releases and upgrade guidance. Operators still deploying MS-MPC should plan migration to MX-SPC3, since MS-MPC is End of Life after Junos OS 22.4 and will not receive further platform support.
Workarounds
- Consolidate SIP call processing into a single service set where operationally feasible, since the crash requires two or more service sets handling SIP
- Disable the SIP ALG on MS-MPC if SIP inspection is not required for the deployment
- Apply stateless firewall filters to rate-limit or block untrusted SIP signaling toward the MS-MPC
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
