CVE-2025-59967: Juniper Junos OS Evolved DoS Vulnerability

CVE-2025-59967 Overview

CVE-2025-59967 is a NULL Pointer Dereference vulnerability [CWE-476] in the Packet Forwarding Engine (PFE) management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved. The flaw affects ACX7000-series routers and allows an unauthenticated, adjacent attacker to trigger a Denial-of-Service (DoS) condition. When specific valid multicast traffic reaches any layer 3 interface, the evo-pfemand process crashes and restarts. Sustained multicast traffic produces a persistent DoS on the affected device. The issue impacts both IPv4 and IPv6 multicast handling.

Critical Impact
Continued receipt of specific multicast traffic on any L3 interface produces a sustained crash-loop of the PFE management daemon, disrupting packet forwarding on affected ACX7000-series routers.

Affected Products

Juniper Junos OS Evolved from 23.2R2-EVO before 23.2R2-S4-EVO
Juniper Junos OS Evolved from 23.4R1-EVO before 23.4R2-EVO
ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 hardware platforms

Discovery Timeline

2025-10-09 - CVE-2025-59967 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59967

Vulnerability Analysis

The vulnerability resides in evo-pfemand, the PFE management daemon responsible for programming and coordinating forwarding state on Junos OS Evolved. The daemon dereferences a NULL pointer when processing certain valid multicast packets received on any layer 3 interface. The dereference causes the process to crash. Junos OS Evolved automatically restarts crashed daemons, but continued receipt of the triggering multicast traffic drives evo-pfemand into a repeated crash-restart loop. Because evo-pfemand is central to PFE state management, this loop disrupts forwarding operations on the router.

Root Cause

The root cause is missing pointer validation in the multicast processing path of evo-pfemand. A specific multicast packet structure exercises a code path that reaches a pointer expected to reference a valid object but which is NULL under these conditions. The unchecked dereference triggers a segmentation fault. The condition is exposed on both IPv4 and IPv6 multicast handling and is not gated by authentication.

Attack Vector

Exploitation requires layer 2 adjacency to the target router. An attacker on the same broadcast domain as any L3 interface can send crafted but syntactically valid multicast traffic to trigger the crash. No credentials, user interaction, or elevated privileges are required. The impact is limited to availability; confidentiality and integrity of forwarded traffic are not affected. Devices running Junos OS Evolved releases prior to 23.2R2-EVO on the listed ACX7000 platforms are not affected. No public proof-of-concept has been released and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Refer to the Juniper Security Advisory JSA103156 for vendor technical details.

Detection Methods for CVE-2025-59967

Indicators of Compromise

Repeated crash and restart events for the evo-pfemand process recorded in Junos OS Evolved system logs.
Core files generated by evo-pfemand on affected ACX7000-series routers.
Loss or intermittent disruption of forwarding services correlated with inbound multicast traffic on any L3 interface.

Detection Strategies

Monitor syslog and evo daemon logs for repeated evo-pfemand termination or restart messages within short time windows.
Alert on generation of new core files under Junos OS Evolved crash directories.
Baseline multicast traffic volumes per L3 interface and alert on unexpected multicast sources or sudden increases from adjacent hosts.

Monitoring Recommendations

Forward Junos OS Evolved system and daemon logs to a centralized log platform for correlation with device health metrics.
Track process uptime for evo-pfemand via SNMP or streaming telemetry and alert on frequent restarts.
Correlate PFE daemon events with interface counters for multicast packets to identify the triggering source.

How to Mitigate CVE-2025-59967

Immediate Actions Required

Identify ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, and ACX7509 devices running Junos OS Evolved releases 23.2R2-EVO through 23.2R2-S3-EVO or 23.4R1-EVO through 23.4R1-S2-EVO.
Schedule upgrades to 23.2R2-S4-EVO, 23.4R2-EVO, or later fixed releases as documented by Juniper.
Restrict multicast traffic on layer 3 interfaces adjacent to untrusted hosts until patching is complete.

Patch Information

Juniper has released fixed versions. Upgrade Junos OS Evolved to 23.2R2-S4-EVO, 23.4R2-EVO, or later on affected ACX7000-series hardware. Full remediation guidance is available in the Juniper Security Advisory JSA103156.

Workarounds

Apply multicast filtering at layer 3 interfaces to drop untrusted or unnecessary multicast traffic reaching the router.
Segment the layer 2 domain to prevent unauthorized adjacent hosts from sending multicast to ACX7000-series interfaces.
Where multicast routing is not required, disable multicast processing on exposed interfaces.

bash

# Verify installed Junos OS Evolved version on affected ACX platforms
show version | match Evolved

# Example: apply a firewall filter to discard unexpected multicast at an L3 interface
set firewall family inet filter LIMIT-MCAST term drop-mcast from destination-address 224.0.0.0/4
set firewall family inet filter LIMIT-MCAST term drop-mcast then discard
set interfaces <ifname> unit 0 family inet filter input LIMIT-MCAST