CVE-2025-52984: Juniper Junos DOS Vulnerability

CVE-2025-52984 Overview

CVE-2025-52984 is a NULL Pointer Dereference vulnerability [CWE-476] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can crash rpd when a static route is configured with a reject next hop and a gNMI query is processed for that route. The daemon crashes and restarts, disrupting routing operations on the affected device.

Critical Impact
A remote attacker can trigger repeated crashes of the routing protocol daemon on Junos OS and Junos OS Evolved devices, causing a denial-of-service condition that impacts network availability.

Affected Products

Juniper Junos OS: all versions before 21.2R3-S9, 21.4 before 21.4R3-S10, 22.2 before 22.2R3-S6, 22.4 before 22.4R3-S6, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, 24.2 before 24.2R1-S2 and 24.2R2
Juniper Junos OS Evolved: all versions before 22.4R3-S7-EVO, 23.2-EVO before 23.2R2-S3-EVO, 23.4-EVO before 23.4R2-S4-EVO
Juniper Junos OS Evolved 24.2-EVO before 24.2R2-EVO

Discovery Timeline

2025-07-11 - CVE-2025-52984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52984

Vulnerability Analysis

The flaw resides in how the routing protocol daemon (rpd) handles gNMI (gRPC Network Management Interface) queries against static routes that reference a reject next hop. When such a query is processed, rpd dereferences a pointer that has not been initialized for the reject next-hop case, terminating the process. The daemon is automatically restarted by the operating system, but during the restart window routing convergence is disrupted and BGP, OSPF, IS-IS, and other adjacencies flap.

Repeated queries allow an attacker to keep the daemon in a crash-restart loop, sustaining the outage without any authentication.

Root Cause

The root cause is missing validation of a next-hop pointer along the gNMI code path that services static-route telemetry lookups. Reject next hops are represented differently from forwarding next hops, and the query handler does not check for the absence of the standard next-hop structure before dereferencing it. This is a classic [CWE-476] NULL pointer dereference in a network-reachable management plane component.

Attack Vector

Exploitation requires network access to the gNMI service on an affected device and the presence of at least one static route configured with a reject next hop. The attacker sends a crafted gNMI subscription or Get request that targets state associated with that static route. No credentials are required for the crash trigger in this vulnerability class, and the impact is limited to availability, per the assigned CVSS 4.0 vector.

No public proof-of-concept or exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-52984

Indicators of Compromise

Repeated rpd process restarts logged in /var/log/messages or in chassisd and init log entries referencing rpd core files.
Unexpected core dumps in /var/crash/ or /var/tmp/ matching the pattern rpd.core.*.
Routing protocol adjacency flaps (BGP, OSPF, IS-IS) correlated in time with inbound gNMI sessions.
gNMI Get or Subscribe requests targeting /network-instances/.../static-routes/ from unexpected source addresses.

Detection Strategies

Monitor Junos syslog for RPD_TASK_REINIT, RPD_SCHED_CALLBACK_LONGRUNTIME, and daemon restart messages tied to gNMI activity.
Inspect gNMI/gRPC access logs for query patterns referencing static routes with reject next hops, especially from unauthenticated or unusual sources.
Baseline the frequency of rpd restarts and alert on any deviation, since a healthy device should exhibit near-zero restart events.

Monitoring Recommendations

Enable structured logging for the gNMI service and forward logs to a centralized SIEM for correlation with routing events.
Track BGP and IGP session state changes and alert when multiple adjacencies drop within a short window on the same device.
Audit which static routes on production devices use reject or discard next hops and prioritize monitoring for those platforms.

How to Mitigate CVE-2025-52984

Immediate Actions Required

Upgrade affected devices to a fixed release listed in Juniper Support Advisory JSA100090.
Restrict gNMI/gRPC service exposure to trusted management networks only using firewall filters and loopback lo0 policies.
Review static route configurations for reject next hops and remove them where alternative constructs are acceptable until patching is complete.

Patch Information

Juniper has released fixed versions in Junos OS 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, 24.2R1-S2, 24.2R2, and later. Junos OS Evolved fixes are available in 22.4R3-S7-EVO, 23.2R2-S3-EVO, 23.4R2-S4-EVO, 24.2R2-EVO, and later. Full details are provided in Juniper Support Advisory JSA100090.

Workarounds

Apply firewall filters on the routing engine loopback interface to permit gNMI only from authorized management hosts.
Disable the gNMI service on devices where it is not required for operations.
Where feasible, replace reject next hops on static routes with alternate configurations that do not trigger the vulnerable code path.

bash

# Example: restrict gNMI/gRPC access to a trusted management prefix
set firewall family inet filter PROTECT-RE term ALLOW-GNMI from source-address 192.0.2.0/24
set firewall family inet filter PROTECT-RE term ALLOW-GNMI from destination-port 32767
set firewall family inet filter PROTECT-RE term ALLOW-GNMI then accept
set firewall family inet filter PROTECT-RE term DENY-GNMI from destination-port 32767
set firewall family inet filter PROTECT-RE term DENY-GNMI then discard
set interfaces lo0 unit 0 family inet filter input PROTECT-RE
commit