CVE-2025-60010: Juniper Junos Auth Bypass Vulnerability

CVE-2025-60010 Overview

CVE-2025-60010 is a password aging policy enforcement flaw in the RADIUS (Remote Authentication Dial-In User Service) client of Juniper Networks Junos OS and Junos OS Evolved. The vulnerability allows an authenticated, network-based attacker to log in to affected devices using expired credentials without being forced to change the password. When a RADIUS server rejects an authentication attempt and signals that the password has expired, the device still grants access if the correct (but expired) password is supplied. This weakness maps to [CWE-262: Not Using Password Aging]. Juniper published the issue in advisory JSA103168 on October 9, 2025.

Critical Impact
Users with expired passwords can continue accessing Juniper network devices, undermining credential lifecycle controls and extending the window in which stale or compromised credentials remain usable.

Affected Products

Junos OS: all versions before 22.4R3-S8, 23.2 before 23.2R2-S4, 23.4 before 23.4R2-S5, 24.2 before 24.2R2-S1, 24.4 before 24.4R1-S3 and 24.4R2
Junos OS Evolved: all versions before 22.4R3-S8-EVO, 23.2 before 23.2R2-S4-EVO, 23.4 before 23.4R2-S5-EVO, 24.2 before 24.2R2-S1-EVO, 24.4 before 24.4R1-S3-EVO and 24.4R2-EVO
Juniper network devices configured to use RADIUS authentication with password aging policies

Discovery Timeline

2025-10-09 - CVE-2025-60010 published to NVD alongside Juniper advisory JSA103168
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60010

Vulnerability Analysis

The flaw resides in how the Junos RADIUS client interprets RADIUS Access-Reject responses that include password-expiration semantics. The RADIUS protocol permits a server to reject an authentication attempt while signaling that the user must change their password before further access is granted. Junos correctly validates the supplied password against the RADIUS backend but fails to honor the accompanying password-change requirement. As a result, users authenticate with a valid but expired credential and gain interactive access without ever performing the mandated password change.

The issue does not weaken authentication itself. An attacker cannot log in with an incorrect password. Instead, the vulnerability erodes credential hygiene by allowing expired passwords to remain functionally valid, defeating password rotation policies that many operators rely on to reduce the impact of leaked or long-lived credentials.

Root Cause

The root cause is missing enforcement logic in the RADIUS client authentication path. The code treats a valid password as sufficient to authorize the session even when the RADIUS server explicitly returns a reject-with-password-change directive. [CWE-262] describes this class of flaw: the application does not enforce password aging even though the backend authority requires it.

Attack Vector

Exploitation requires network access to a management interface (SSH, Telnet, J-Web, or NETCONF) on an affected Junos device and knowledge of a valid but expired user password. The attacker submits normal authentication with the expired credential. The RADIUS server rejects the request and signals that the password must change, but Junos grants access anyway with the privileges assigned to that account. No additional exploitation primitive, malware, or protocol manipulation is required. See the Juniper Security Advisory JSA103168 for full protocol-level details.

Detection Methods for CVE-2025-60010

Indicators of Compromise

Successful Junos login events for user accounts whose passwords have been marked expired by the upstream RADIUS server.
RADIUS server logs showing Access-Reject responses with password-expired attributes immediately followed by successful device sessions for the same principal.
Interactive or NETCONF sessions from accounts that have not performed a password change within the enforced rotation window.

Detection Strategies

Correlate RADIUS server accounting and reject logs with Junos sshd, login, and mgd authentication events to identify accepted sessions that should have been blocked.
Baseline expected password-change events on the identity provider and alert when accounts continue to authenticate past their expiration date without a recorded credential update.
Review Junos syslog output at facility authorization and daemon for login success events tied to accounts flagged as expired.

Monitoring Recommendations

Forward Junos and RADIUS logs to a centralized analytics platform and build correlation rules for reject-then-accept sequences per user within a short time window.
Monitor management-plane access (SSH, J-Web, NETCONF) for logins by privileged accounts and validate that credentials are within policy.
Track configuration and command execution on network devices to detect unexpected activity from accounts operating with stale credentials.

How to Mitigate CVE-2025-60010

Immediate Actions Required

Upgrade affected devices to a fixed Junos OS or Junos OS Evolved release listed in JSA103168 as soon as maintenance windows allow.
Force an out-of-band password reset for any RADIUS-managed account currently past its expiration date and confirm the change was applied at the identity provider.
Restrict management-plane access to trusted jump hosts and administrative networks using firewall filters and system services access lists.
Enable multi-factor authentication in front of RADIUS where supported to reduce reliance on password aging as a sole compensating control.

Patch Information

Juniper Networks addressed the issue in Junos OS 22.4R3-S8, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, 24.4R2-S1, and later releases. Equivalent fixes are available for Junos OS Evolved with the -EVO suffix. Refer to the Juniper Security Advisory JSA103168 for the complete list of fixed builds and platform applicability.

Workarounds

Manage password expiration and rotation on the RADIUS or identity provider side by disabling accounts when passwords lapse instead of relying on the device to enforce the change.
Reduce exposure of the management plane using firewall filters, dedicated out-of-band networks, and bastion hosts until patched builds are deployed.
Audit RADIUS-authenticated user accounts on a scheduled cadence and remove or disable stale accounts to shrink the pool of credentials that could remain valid past expiration.

bash

# Example: restrict management access on Junos until patched
set firewall family inet filter MGMT-ACL term allow-admin from source-address 10.10.0.0/24
set firewall family inet filter MGMT-ACL term allow-admin then accept
set firewall family inet filter MGMT-ACL term default then discard
set interfaces fxp0 unit 0 family inet filter input MGMT-ACL
commit