CVE-2025-60011 Overview
An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows an unauthenticated, network-based attacker to cause an availability impact for downstream devices through manipulation of BGP attributes.
When an affected device receives a specific optional, transitive BGP attribute over an existing BGP session, it will be erroneously modified before propagation to peers. When the attribute is detected as malformed by the peers, these peers will most likely terminate the BGP sessions with the affected devices, thereby causing an availability impact due to the resulting routing churn.
Critical Impact
Network-based attackers can disrupt BGP sessions between network devices, causing routing instability and potential network-wide availability issues for downstream infrastructure.
Affected Products
- Junos OS: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2
- Junos OS Evolved: all versions before 22.4R3-S8-EVO, 23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO
Discovery Timeline
- 2026-01-15 - CVE CVE-2025-60011 published to NVD
- 2026-01-16 - Last updated in NVD database
Technical Details for CVE-2025-60011
Vulnerability Analysis
This vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions), indicating that the routing protocol daemon fails to properly handle certain edge cases when processing BGP attributes. The flaw resides in how the rpd processes optional, transitive BGP attributes received over established BGP sessions.
The vulnerability is network-exploitable without requiring authentication, making it accessible to any attacker who can send BGP traffic to an affected device. When successfully exploited, the vulnerability does not directly impact the targeted device but rather causes it to propagate malformed attributes to its BGP peers, creating a cascading effect that can lead to widespread BGP session terminations.
The impact extends beyond the initial target device to affect the broader network infrastructure, as peer devices detecting malformed attributes will terminate their BGP sessions, leading to routing table updates and network convergence events that can cause significant service disruption.
Root Cause
The root cause of this vulnerability lies in the improper validation and handling of optional, transitive BGP attributes within the routing protocol daemon. Specifically, the rpd fails to properly check for unusual or exceptional conditions when processing certain BGP attributes, resulting in erroneous modification of these attributes before they are propagated to BGP peers.
This improper handling means that valid BGP attributes received by the affected device are transformed into malformed attributes during the forwarding process, violating the BGP specification and causing peer devices to reject the sessions.
Attack Vector
The attack vector for CVE-2025-60011 leverages the network-accessible BGP protocol. An attacker can exploit this vulnerability by:
- Establishing or utilizing an existing BGP session with the target device
- Sending specially crafted BGP UPDATE messages containing specific optional, transitive attributes
- The affected rpd improperly processes and modifies these attributes
- The malformed attributes are propagated to BGP peers
- Peer devices detect the malformed attributes and terminate their BGP sessions
- Routing churn occurs as the network reconverges, causing availability impact
The vulnerability manifests in the BGP attribute handling within the routing protocol daemon. When specific optional, transitive BGP attributes are received, the rpd erroneously modifies them during the propagation process. This modification causes the attributes to become malformed from the perspective of receiving peers, triggering session terminations. For detailed technical information, refer to the Juniper Security Advisory JSA103161.
Detection Methods for CVE-2025-60011
Indicators of Compromise
- Unexpected BGP session flapping or terminations with multiple peers
- Increased BGP UPDATE and NOTIFICATION messages in logs
- Routing table instability or frequent route changes
- Log entries indicating malformed BGP attribute errors from peer devices
Detection Strategies
- Monitor BGP session states for unexpected transitions from Established to Idle or Active
- Analyze BGP NOTIFICATION messages for attribute-related error codes
- Review rpd logs for unusual attribute processing warnings or errors
- Implement BGP monitoring tools to detect abnormal session behavior patterns
Monitoring Recommendations
- Configure SNMP traps or syslog alerts for BGP session state changes
- Implement network-level monitoring to detect unusual BGP traffic patterns
- Deploy route monitoring to identify unexpected routing table changes
- Establish baseline BGP behavior metrics to identify anomalies
How to Mitigate CVE-2025-60011
Immediate Actions Required
- Identify all Junos OS and Junos OS Evolved devices running vulnerable versions
- Prioritize patching of devices that are BGP route reflectors or have many BGP peers
- Review BGP peering configurations and consider temporary filtering of optional transitive attributes
- Implement monitoring for BGP session instability
Patch Information
Juniper Networks has released patched versions of Junos OS and Junos OS Evolved to address this vulnerability. Organizations should upgrade to the following minimum versions:
Junos OS:
- Version 22.4R3-S8 or later for 22.x releases
- Version 23.2R2-S5 or later for 23.2 releases
- Version 23.4R2-S6 or later for 23.4 releases
- Version 24.2R2-S2 or later for 24.2 releases
- Version 24.4R2 or later for 24.4 releases
Junos OS Evolved:
- Version 22.4R3-S8-EVO or later for 22.x releases
- Version 23.2R2-S5-EVO or later for 23.2 releases
- Version 23.4R2-S6-EVO or later for 23.4 releases
- Version 24.2R2-S2-EVO or later for 24.2 releases
- Version 24.4R2-EVO or later for 24.4 releases
Refer to the Juniper Security Advisory JSA103161 for complete patch information and download links via the Juniper Support Portal.
Workarounds
- Implement strict BGP filtering policies to limit accepted optional transitive attributes where operationally feasible
- Configure route policies to control BGP attribute propagation
- Consider implementing BGP session authentication (TCP-AO or MD5) to limit unauthorized BGP sessions
- Deploy network segmentation to limit exposure of BGP-speaking devices
# Verify current Junos OS version
show version
# Check BGP session status for anomalies
show bgp summary
# Review BGP neighbor status
show bgp neighbor
# Monitor for BGP-related log messages
show log messages | match rpd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
