CVE-2025-59957: Juniper Junos Auth Bypass Vulnerability

CVE-2025-59957 Overview

CVE-2025-59957 is an Origin Validation Error [CWE-346] in Juniper Networks Junos OS running on EX4600 Series and QFX5000 Series switches. An unauthenticated attacker with physical access can modify an insufficiently protected defaults configuration file to inject hidden Junos configuration statements. The injected content merges into the running configuration without appearing in operator-visible views, enabling covert account creation, unauthorized network access, and full device control. The backdoor persists across reboots and even zeroization, making standard recovery procedures ineffective. Juniper published advisory JSA103146 on October 9, 2025.

Critical Impact
The backdoor survives zeroization and reboots. Only reinstallation from physical media restores a trusted state.

Affected Products

Juniper Junos OS on EX4600 and EX4650 switches, all versions before 21.4R3
Juniper Junos OS 22.2 versions before 22.2R3-S3 on affected platforms
QFX5000 Series: QFX5110, QFX5120, QFX5130, QFX5200, QFX5210, QFX5220, QFX5230-64CD, QFX5240, QFX5241, and QFX5700

Discovery Timeline

2025-10-09 - CVE-2025-59957 published to NVD and Juniper advisory JSA103146 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59957

Vulnerability Analysis

The flaw resides in how Junos OS on EX4600 and QFX5000 platforms consumes the platform defaults configuration file at /etc/config/<platform>-defaults[-flex].conf. This file is insufficiently protected on affected devices. When a device is not configured with a root password, an attacker with physical access can modify the file directly. On subsequent commits or boots, the file's contents are appended to the active Junos configuration but remain hidden from standard operator inspection commands.

Because the injected statements do not surface in show configuration output, operators cannot detect added users, static routes, firewall exceptions, or management access changes through normal review. The persistence characteristic is notable: standard remediation actions including reboot and request system zeroize do not remove the malicious statements, since the defaults file is preserved and reapplied.

Root Cause

Junos OS trusts the platform defaults configuration file as an authoritative source without validating its origin or integrity. Combined with permissive filesystem permissions and an unset root password, this creates an origin validation gap where attacker-modified content is indistinguishable from vendor-shipped defaults.

Attack Vector

Exploitation requires physical access to the device and no configured root password. The attacker boots into an environment that permits filesystem write access, edits the <platform>-defaults[-flex].conf file, and inserts arbitrary Junos configuration. Upon reload, the injected configuration takes effect silently. Refer to Juniper Security Advisory JSA103146 for vendor-supplied technical detail.

Detection Methods for CVE-2025-59957

Indicators of Compromise

Modified /etc/config/<platform>-defaults.conf or /etc/config/<platform>-defaults-flex.conf file containing statements not present in the original Juniper software image
Unexpected user accounts, remote access permissions, or IP configuration active on the device but absent from show configuration output
Discrepancy between operator-known configuration and observed device behavior such as unexplained management sessions or ACL bypasses

Detection Strategies

Extract the original defaults file from the Juniper software image and perform a byte-level comparison against the file on the running device. Contact Juniper Technical Assistance Center (JTAC) for the documented extraction procedure.
Audit committed and effective configuration state through multiple interfaces, including the shell and diagnostic commands, to identify statements not visible through standard CLI views.
Review physical access logs, console session records, and USB or removable media events for the affected switches.

Monitoring Recommendations

Forward Junos syslog and authentication events to a centralized logging or SIEM platform and alert on new user creation, permission changes, and unexpected commit activity.
Baseline the hash of /etc/config/<platform>-defaults[-flex].conf on each device and monitor for changes over time.
Track physical and out-of-band management access to EX4600 and QFX5000 devices, correlating personnel access with configuration change windows.

How to Mitigate CVE-2025-59957

Immediate Actions Required

Set a root password on every affected EX4600 and QFX5000 device to remove the precondition that enables the attack path.
Inspect /etc/config/<platform>-defaults[-flex].conf on every in-scope device and compare against the pristine file from the original Junos image.
If tampering is confirmed, reinstall the device from trusted physical media. Zeroization alone does not remove the backdoor.
Restrict and log all physical access to affected switches, including console, USB, and removable storage ports.

Patch Information

Juniper Networks fixed the issue in Junos OS 21.4R3, 22.2R3-S3, and later releases on EX4600 and QFX5000 Series. Upgrade all affected devices to a fixed release as documented in Juniper Security Advisory JSA103146. For device reinstallation from physical media, follow the Juniper QFX Device Formatting Procedure.

Workarounds

Configure a strong root password on all affected devices to close the exploitation precondition until upgrade is possible.
Enforce strict physical security controls for switches deployed in shared or unmanned facilities.
Maintain out-of-band configuration backups and periodically validate on-device configuration state against the authoritative source of truth.