CVE-2025-52985 Overview
CVE-2025-52985 is a firewall filter bypass vulnerability in the Routing Engine of Juniper Networks Junos OS Evolved. The flaw stems from a Use of Incorrect Operator [CWE-480] in prefix list evaluation logic. When a firewall filter applied to the lo0 or re:mgmt interface references a prefix list via from prefix-list and that prefix list contains more than 10 entries, the match fails silently. Packets destined to or from the local device pass without being filtered. Both IPv4 and IPv6 prefixes are affected. An unauthenticated, network-based attacker can bypass security restrictions intended to protect the control plane and management interface.
Critical Impact
Firewall filters protecting the Routing Engine fail to enforce policy when prefix lists exceed 10 entries, exposing the control plane and management interface to unauthorized traffic.
Affected Products
- Junos OS Evolved 23.2R2-S3-EVO versions before 23.2R2-S4-EVO
- Junos OS Evolved 23.4R2-S3-EVO versions before 23.4R2-S5-EVO
- Junos OS Evolved 24.2R2-EVO versions before 24.2R2-S1-EVO, and 24.4-EVO versions before 24.4R1-S3-EVO / 24.4R2-EVO
Discovery Timeline
- 2025-07-11 - CVE-2025-52985 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-52985
Vulnerability Analysis
The vulnerability resides in how the Routing Engine firewall on Junos OS Evolved evaluates prefix lists referenced by filter terms. When a firewall filter term uses from prefix-list <name> and that list holds more than 10 entries, the match operation returns a false negative. The filter term does not apply, and the associated then action, typically discard or reject, is never executed. Packets bound for or originating from the local device pass unfiltered.
The scope depends on filter direction. On the re:mgmt interface, both input and output filters are affected. On the lo0 interface, only output filters are affected. Because the lo0 interface anchors control-plane protection on Juniper routers, the flaw undermines a common hardening pattern used to restrict SSH, NETCONF, BGP, and SNMP access to the Routing Engine. The issue applies to prefix lists that contain IPv4 or IPv6 entries.
Root Cause
The defect is classified as Use of Incorrect Operator [CWE-480]. The prefix list evaluation routine uses a comparison or boundary operator that misbehaves once the list length exceeds 10 entries, causing the match to fail and the filter term to be skipped. Junos OS Evolved versions before 23.2R1-EVO are not affected.
Attack Vector
A remote, unauthenticated attacker crafts traffic sourced from or destined to addresses that should be blocked by the prefix-list-based filter. When the referenced prefix list contains more than 10 entries, the filter fails open. The attacker reaches services on the Routing Engine or the management interface that operators believed were restricted. No authentication, user interaction, or special privileges are required.
The vulnerability manifests only in Junos OS Evolved firewall filter evaluation. See the Juniper Security Advisory JSA100091 for the vendor's technical description and complete list of affected release trains.
Detection Methods for CVE-2025-52985
Indicators of Compromise
- Unexpected inbound connections to Routing Engine services such as SSH, NETCONF, or SNMP from source addresses listed in a deny prefix list larger than 10 entries.
- Successful authentication attempts or scan traffic on re:mgmt from networks that should be blocked by input filters.
- Outbound sessions from lo0 or re:mgmt to destinations that a configured output filter should have dropped.
Detection Strategies
- Audit every Junos OS Evolved device configuration for firewall filters bound to lo0 output or the re:mgmt interface that reference a prefix-list with more than 10 entries.
- Compare running configurations against expected control-plane ACLs and generate alerts when prefix list sizes cross the 10-entry threshold on affected releases.
- Correlate NetFlow, sFlow, or IPFIX telemetry against the intended filter policy to identify traffic that reached the Routing Engine despite deny rules.
Monitoring Recommendations
- Ingest Junos syslog and authentication logs into a centralized analytics platform and alert on management-plane logins from unexpected source prefixes.
- Track configuration changes to firewall family inet and firewall family inet6 filters, and flag any new prefix-list references that could trigger the bypass.
- Baseline control-plane traffic volumes and alert on deviations that suggest filters are not enforcing as configured.
How to Mitigate CVE-2025-52985
Immediate Actions Required
- Upgrade to a fixed Junos OS Evolved release: 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S3-EVO, 24.4R2-EVO, or later.
- Inventory all firewall filters applied to lo0 output and re:mgmt input/output and identify those referencing prefix lists with more than 10 entries.
- Restrict management access at upstream devices until affected systems are patched.
Patch Information
Juniper Networks has released fixed builds across each affected release train. Refer to Juniper Security Advisory JSA100091 for the authoritative list of fixed versions and download links. Junos OS Evolved versions before 23.2R1-EVO are not vulnerable.
Workarounds
- Split prefix lists larger than 10 entries into multiple lists of 10 or fewer entries and reference each in a separate filter term with the same action.
- Replace from prefix-list matches with explicit from source-address or from destination-address terms, which are not subject to the incorrect operator flaw.
- Enforce equivalent control-plane restrictions on adjacent devices or out-of-band management networks until the fixed release is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
