CVE-2025-59958

Junos OS Evolved: PTX Series: When a firewall filter rejects traffic these packets are erroneously sent to the RE

Published Oct 9, 2025 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability.

When an output firewall filter is configured with one or more terms where the action is 'reject', packets matching these terms are erroneously sent to the Routing Engine (RE) and further processed there. Processing of these packets will consume limited RE resources. Also responses from the RE back to the source of this traffic could reveal confidential information about the affected device.
This issue only applies to firewall filters applied to WAN or revenue interfaces, so not the mgmt or lo0 interface of the routing-engine, nor any input filters.

This issue affects Junos OS Evolved on PTX Series:



* all versions before 22.4R3-EVO,
* 23.2 versions before 23.2R2-EVO.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO, and all subsequent releases.


Vendor Workaround

To avoid this issue remove the affected reject action from the respective term(s) and replace it with discard, or add log or syslog actions.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Juniper ptx1000
Juniper ptx10001-36mr
Juniper ptx10002
Juniper ptx10003
Juniper ptx10004
Juniper ptx10008
Juniper ptx10016
Juniper ptx3000
Juniper ptx5000
CPEs cpe:2.3:h:juniper:ptx10001-36mr:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10002:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10003:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx1000:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx3000:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:ptx5000:-:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r2-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:22.4:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*
Vendors & Products Juniper ptx1000
Juniper ptx10001-36mr
Juniper ptx10002
Juniper ptx10003
Juniper ptx10004
Juniper ptx10008
Juniper ptx10016
Juniper ptx3000
Juniper ptx5000
Type Values Removed Values Added
First Time appeared Juniper
Juniper junos Os Evolved
Vendors & Products Juniper
Juniper junos Os Evolved
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability. When an output firewall filter is configured with one or more terms where the action is 'reject', packets matching these terms are erroneously sent to the Routing Engine (RE) and further processed there. Processing of these packets will consume limited RE resources. Also responses from the RE back to the source of this traffic could reveal confidential information about the affected device. This issue only applies to firewall filters applied to WAN or revenue interfaces, so not the mgmt or lo0 interface of the routing-engine, nor any input filters. This issue affects Junos OS Evolved on PTX Series: * all versions before 22.4R3-EVO, * 23.2 versions before 23.2R2-EVO.
Title Junos OS Evolved: PTX Series: When a firewall filter rejects traffic these packets are erroneously sent to the RE
Weaknesses CWE-754
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/RE:M'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
juniper
Published
Updated
Oct 9, 2025, 7:05 PM
Reserved
Sep 23, 2025, 6:19 PM
Status
Analyzed
Published
Oct 9, 2025, 4:15 PM
Modified
Oct 8, 2026, 1:10 PM