CVE-2025-59980: Juniper Junos Auth Bypass Vulnerability

CVE-2025-59980 Overview

CVE-2025-59980 is an Authentication Bypass by Primary Weakness [CWE-305] in the File Transfer Protocol (FTP) server of Juniper Networks Junos OS. When the FTP server is enabled and a user named ftp or anonymous is configured, that account can log in without supplying the configured password. The attacker then obtains read-write access to that user's home directory over the network without prior authentication.

The issue affects Junos OS versions prior to 22.4R3-S8, 23.2R2-S3, and 23.4R2. Juniper published the fix in advisory JSA103167.

Critical Impact
An unauthenticated, network-based attacker can log in as ftp or anonymous without the configured password and read or write files inside that user's home directory on the Junos OS device.

Affected Products

Juniper Networks Junos OS: all versions before 22.4R3-S8
Juniper Networks Junos OS 23.2 versions before 23.2R2-S3
Juniper Networks Junos OS 23.4 versions before 23.4R2

Discovery Timeline

2025-10-09 - CVE-2025-59980 published to the National Vulnerability Database (NVD)
2026-06-17 - Entry last updated in the NVD database

Technical Details for CVE-2025-59980

Vulnerability Analysis

The flaw resides in the FTP server component of Junos OS. When an administrator enables FTP and provisions a local user named ftp or anonymous, the server does not enforce password validation for that account. A remote attacker connecting to TCP port 21 can authenticate using either username and any password, or with an empty password, and receive an interactive FTP session.

Once authenticated, the attacker has read-write access to the user's home directory. The attacker can retrieve stored files and upload new files within that directory. The attack requires no user interaction and no valid credentials.

The vulnerability is classified under CWE-305 (Authentication Bypass by Primary Weakness), reflecting a design defect where the credential check for these specific usernames is skipped. Exploitation is bounded by filesystem permissions of the ftp or anonymous account, so direct root compromise is not expected. However, attacker-controlled files in the FTP home directory can facilitate secondary attacks such as configuration tampering or delivery of tooling.

Root Cause

The FTP daemon in the affected Junos OS releases treats logins for the usernames ftp and anonymous as pre-authenticated, bypassing the configured password check. The condition depends solely on the username string, so any configuration that provisions those accounts inherits the bypass.

Attack Vector

Attackers reach the vulnerability over the network by connecting to the FTP service on an exposed Junos OS device. No prior credentials, tokens, or user interaction are required. Any host that can route packets to the management or transit interface running FTP is a viable source.

Because no verified proof-of-concept code is published, exploitation is described in prose. The attacker opens an FTP control connection to the device, issues a USER ftp or USER anonymous command followed by any string for PASS, and then uses standard RETR, STOR, DELE, and LIST verbs against the account's home directory. See the Juniper Security Advisory JSA103167 for vendor-confirmed technical details.

Detection Methods for CVE-2025-59980

Indicators of Compromise

Successful FTP logins to Junos OS devices where the username field is ftp or anonymous and the source is outside expected administrative networks.
New, modified, or unexpected files in the home directories of the ftp or anonymous accounts on Junos OS devices.
Repeated FTP control-channel connections (TCP port 21) to routing or switching infrastructure from workstation or internet ranges.

Detection Strategies

Audit Junos configurations for system services ftp and for locally defined ftp or anonymous user classes; the presence of both conditions indicates exposure.
Correlate authentication events from Junos syslog with source IP reputation and geolocation to surface anonymous logins from untrusted networks.
Alert on any FTP write operation (STOR, APPE, DELE, RNFR) targeting network devices, since FTP writes are rare on production routers.

Monitoring Recommendations

Forward Junos interactive-commands and authorization syslog facilities to a central SIEM and build detections around FTP session records.
Enable NetFlow or firewall logging for TCP/21 traffic destined to management addresses and review baselines weekly.
Track filesystem changes to /var/home/ftp and equivalent paths on Junos devices via configuration snapshots and integrity comparison.

How to Mitigate CVE-2025-59980

Immediate Actions Required

Upgrade Junos OS to 22.4R3-S8, 23.2R2-S3, 23.4R2, or any later release that includes the fix from advisory JSA103167.
Disable the FTP server on all Junos devices where it is not operationally required by removing set system services ftp from the configuration.
Remove any locally configured users named ftp or anonymous and rotate credentials for any account that shared the affected home directory.
Restrict management-plane access to FTP with firewall filters that permit only trusted administrative subnets.

Patch Information

Juniper Networks addressed CVE-2025-59980 in Junos OS releases 22.4R3-S8, 23.2R2-S3, and 23.4R2. Refer to the Juniper Security Advisory JSA103167 for the complete list of fixed builds and upgrade guidance.

Workarounds

Disable the FTP service entirely with delete system services ftp and use SCP or SFTP over SSH for file transfers.
Apply a Junos firewall filter to the loopback interface that drops inbound TCP/21 traffic from all sources except a defined management prefix list.
Remove or rename the ftp and anonymous local accounts so that no user record matches the bypass condition.

bash

# Configuration example: disable FTP and filter port 21 on Junos OS
delete system services ftp

set firewall family inet filter PROTECT-RE term BLOCK-FTP from protocol tcp
set firewall family inet filter PROTECT-RE term BLOCK-FTP from destination-port 21
set firewall family inet filter PROTECT-RE term BLOCK-FTP then discard
set interfaces lo0 unit 0 family inet filter input PROTECT-RE
commit