CVE-2025-60007: Juniper Junos OS Denial-of-Service Flaw

CVE-2025-60007 Overview

A NULL Pointer Dereference vulnerability exists in the chassis daemon (chassisd) of Juniper Networks Junos OS running on MX, SRX, and EX Series devices. This vulnerability allows a local attacker with low privileges to cause a Denial-of-Service (DoS) condition by executing the show chassis command with specifically crafted options.

When exploited, the chassisd process crashes and restarts, causing all chassis components except the Routing Engine (RE) to reinitialize. This results in a complete service outage, though the system will automatically recover. The local attack vector requires an attacker to have existing access to the device command line.

Critical Impact

Local attackers with low privileges can trigger complete service outages on Juniper MX, SRX, and EX Series devices, disrupting network operations until automatic recovery completes.

Affected Products

• Junos OS on MX Series: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2
• Junos OS on SRX Series: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2
• Junos OS on EX Series: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2

Discovery Timeline

• 2026-01-15 - CVE CVE-2025-60007 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-60007

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The chassisd daemon is responsible for managing hardware components and chassis-related operations on Juniper devices. When a user with local access executes the show chassis command with maliciously crafted options, the daemon fails to properly validate or handle certain input parameters, resulting in an attempt to dereference a NULL pointer.

The NULL pointer dereference causes the chassisd process to crash unexpectedly. Since chassisd is a critical system daemon responsible for chassis management, its crash triggers a reinitialization of all chassis components except the Routing Engine. This cascade effect causes a complete service outage on the affected device.

The vulnerability requires local access and low privileges to exploit, meaning an attacker would need to have authenticated access to the device's CLI. While this limits the attack surface compared to remote vulnerabilities, insider threats or compromised accounts could leverage this flaw to disrupt network services.

Root Cause

The root cause of this vulnerability is improper input validation within the chassisd daemon when processing arguments passed to the show chassis command. The daemon fails to check for NULL or invalid pointer values before attempting to access memory, leading to a NULL pointer dereference condition when specific malformed options are provided.

Attack Vector

The attack requires local access to the Juniper device with low-privilege CLI credentials. An attacker executes the show chassis command with specially crafted options that trigger the NULL pointer dereference in chassisd. The vulnerability exploits insufficient input validation in the command parser, causing the daemon to crash.

The attack mechanism involves crafting specific command-line options for the show chassis command that the chassisd daemon does not properly validate. When the daemon attempts to process these malformed options, it encounters a NULL pointer condition that causes an immediate crash. For detailed technical information, refer to the Juniper Security Advisory JSA103173.

Detection Methods for CVE-2025-60007

Indicators of Compromise

• Unexpected chassisd process crashes and restarts in system logs
• Multiple system messages indicating chassis component reinitializations
• Service outages followed by automatic recovery on MX, SRX, or EX Series devices
• Audit logs showing unusual show chassis command executions with non-standard options

Detection Strategies

• Monitor system logs for chassisd crash events and unexpected daemon restarts
• Implement alerting on repeated chassis component reinitialization messages
• Review CLI command history for anomalous show chassis command patterns
• Configure SIEM rules to detect patterns of service disruption followed by automatic recovery

Monitoring Recommendations

• Enable comprehensive logging for all CLI command executions on Juniper devices
• Set up real-time alerts for chassisd process failures
• Monitor device availability metrics to detect service disruption patterns
• Correlate user access logs with chassis daemon events to identify potential exploitation attempts

How to Mitigate CVE-2025-60007

Immediate Actions Required

• Update affected Juniper Junos OS installations to patched versions immediately
• Review and restrict user access to CLI commands, particularly chassis-related commands
• Audit user accounts with CLI access and remove unnecessary privileges
• Implement strict role-based access control (RBAC) to limit show chassis command access

Patch Information

Juniper Networks has released patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Junos OS 22.4R3-S8 or later for versions prior to 22.4
• Junos OS 23.2R2-S5 or later for 23.2 versions
• Junos OS 23.4R2-S6 or later for 23.4 versions
• Junos OS 24.2R2-S2 or later for 24.2 versions
• Junos OS 24.4R2 or later for 24.4 versions

Refer to the Juniper Security Advisory JSA103173 for complete patch details and download links via the Juniper Support Portal.

Workarounds

• Restrict CLI access to only trusted administrators with verified credentials
• Implement network segmentation to limit access to device management interfaces
• Use out-of-band management networks to reduce exposure of CLI access
• Monitor and log all CLI sessions for anomaly detection and forensic purposes

# Example: Restrict CLI access using login classes
# Configure restrictive login class for non-admin users
set system login class restricted-user permissions view
set system login class restricted-user deny-commands "show chassis.*"

# Apply restricted class to limited users
set system login user limited-user class restricted-user