CVE-2025-59964

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59964", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2025-09-23T18:19:06.955Z", "datePublished": "2025-10-09T15:46:25.285Z", "dateUpdated": "2025-10-09T19:00:04.954Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["SRX4700"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "24.4R1-S3, 24.4R2", "status": "affected", "version": "24.4", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Below is the configuration to check if sampling is enabled. <br><br></span><tt><span style=\"background-color: rgb(255, 255, 255);\">&nbsp; [ forwarding-options sampling ]</span></tt><br>"}], "value": "Below is the configuration to check if sampling is enabled. \n\n\u00a0 [ forwarding-options sampling ]"}], "datePublic": "2025-10-08T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700&nbsp;<span style=\"background-color: rgb(251, 251, 251);\">devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).</span></span><br><br><span style=\"background-color: rgb(255, 255, 255);\">When forwarding-options sampling&nbsp;</span>is enabled, receipt&nbsp;of any traffic destined to the Routing Engine (RE) by the PFE line card&nbsp;<span style=\"background-color: rgb(251, 251, 251);\">leads to an FPC crash and restart, resulting in a Denial of Service (DoS). <br><br>Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.<span style=\"background-color: rgb(251, 251, 251);\"><br></span><p></p></span><p>This issue affects&nbsp;Junos OS on SRX4700:&nbsp;</p><p></p><ul><li>from 24.4 before 24.4R1-S3, 24.4R2</li></ul>This issue affects IPv4 and IPv6.<br><p></p>"}], "value": "A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700\u00a0devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\n\nWhen forwarding-options sampling\u00a0is enabled, receipt\u00a0of any traffic destined to the Routing Engine (RE) by the PFE line card\u00a0leads to an FPC crash and restart, resulting in a Denial of Service (DoS). \n\nContinued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.\n\n\nThis issue affects\u00a0Junos OS on SRX4700:\u00a0\n\n\n\n * from 24.4 before 24.4R1-S3, 24.4R2\n\n\nThis issue affects IPv4 and IPv6."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2025-10-09T15:46:25.285Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://supportportal.juniper.net/JSA103153"}, {"tags": ["technical-description"], "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/sampling-edit-forwarding-options.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The following software releases have been updated to resolve this specific issue: <br><br>Junos OS: 24.4R1-S3, 24.4R2,&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">25.2R1 and all subsequent releases.</span><br>"}], "value": "The following software releases have been updated to resolve this specific issue: \n\nJunos OS: 24.4R1-S3, 24.4R2,\u00a025.2R1 and all subsequent releases."}], "source": {"advisory": "JSA103153", "defect": ["1867583"], "discovery": "USER"}, "title": "Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restart", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "To workaround this issue an administrator must block all traffic from the PFE line card to the Routing Engine (RE) until a fix can be taken.<br>Even while under a persistent DoS attack the RE will continue to be accessible to administrators through non-PFE line card interfaces E.g. Console, FXP0.<br>"}], "value": "To workaround this issue an administrator must block all traffic from the PFE line card to the Routing Engine (RE) until a fix can be taken.\nEven while under a persistent DoS attack the RE will continue to be accessible to administrators through non-PFE line card interfaces E.g. Console, FXP0."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T18:59:53.970460Z", "id": "CVE-2025-59964", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:00:04.954Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T18:59:53.970460Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T18:59:58.500Z"}}], "cna": {"title": "Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the RE will cause the forwarding line card to crash and restart", "source": {"defect": ["1867583"], "advisory": "JSA103153", "discovery": "USER"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 8.7, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M/U:Green", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Juniper Networks", "product": "Junos OS", "versions": [{"status": "affected", "version": "24.4", "lessThan": "24.4R1-S3, 24.4R2", "versionType": "semver"}], "platforms": ["SRX4700"], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "base64": false}]}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue: \n\nJunos OS: 24.4R1-S3, 24.4R2,\u00a025.2R1 and all subsequent releases.", "supportingMedia": [{"type": "text/html", "value": "The following software releases have been updated to resolve this specific issue: <br><br>Junos OS: 24.4R1-S3, 24.4R2,&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">25.2R1 and all subsequent releases.</span><br>", "base64": false}]}], "datePublic": "2025-10-08T16:00:00.000Z", "references": [{"url": "https://supportportal.juniper.net/JSA103153", "tags": ["vendor-advisory"]}, {"url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/sampling-edit-forwarding-options.html", "tags": ["technical-description"]}], "workarounds": [{"lang": "en", "value": "To workaround this issue an administrator must block all traffic from the PFE line card to the Routing Engine (RE) until a fix can be taken.\nEven while under a persistent DoS attack the RE will continue to be accessible to administrators through non-PFE line card interfaces E.g. Console, FXP0.", "supportingMedia": [{"type": "text/html", "value": "To workaround this issue an administrator must block all traffic from the PFE line card to the Routing Engine (RE) until a fix can be taken.<br>Even while under a persistent DoS attack the RE will continue to be accessible to administrators through non-PFE line card interfaces E.g. Console, FXP0.<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700\u00a0devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\n\nWhen forwarding-options sampling\u00a0is enabled, receipt\u00a0of any traffic destined to the Routing Engine (RE) by the PFE line card\u00a0leads to an FPC crash and restart, resulting in a Denial of Service (DoS). \n\nContinued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.\n\n\nThis issue affects\u00a0Junos OS on SRX4700:\u00a0\n\n\n\n * from 24.4 before 24.4R1-S3, 24.4R2\n\n\nThis issue affects IPv4 and IPv6.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700&nbsp;<span style=\"background-color: rgb(251, 251, 251);\">devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).</span></span><br><br><span style=\"background-color: rgb(255, 255, 255);\">When forwarding-options sampling&nbsp;</span>is enabled, receipt&nbsp;of any traffic destined to the Routing Engine (RE) by the PFE line card&nbsp;<span style=\"background-color: rgb(251, 251, 251);\">leads to an FPC crash and restart, resulting in a Denial of Service (DoS). <br><br>Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.<span style=\"background-color: rgb(251, 251, 251);\"><br></span><p></p></span><p>This issue affects&nbsp;Junos OS on SRX4700:&nbsp;</p><p></p><ul><li>from 24.4 before 24.4R1-S3, 24.4R2</li></ul>This issue affects IPv4 and IPv6.<br><p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource"}]}], "configurations": [{"lang": "en", "value": "Below is the configuration to check if sampling is enabled. \n\n\u00a0 [ forwarding-options sampling ]", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Below is the configuration to check if sampling is enabled. <br><br></span><tt><span style=\"background-color: rgb(255, 255, 255);\">&nbsp; [ forwarding-options sampling ]</span></tt><br>", "base64": false}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2025-10-09T15:46:25.285Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59964", "state": "PUBLISHED", "dateUpdated": "2025-10-09T19:00:04.954Z", "dateReserved": "2025-09-23T18:19:06.955Z", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "datePublished": "2025-10-09T15:46:25.285Z", "assignerShortName": "juniper"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["SRX4700"], "product": "Junos OS", "vendor": "Juniper Networks", "versions": [{"lessThan": "24.4R1-S3, 24.4R2", "status": "affected", "version": "24.4", "versionType": "semver"}]}], "source": "sirt@juniper.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*", "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*", "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21", "vulnerable": true}, {"criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*", "matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:juniper:srx4700:-:*:*:*:*:*:*:*", "matchCriteriaId": "462CFD52-D3E2-4F7A-98AC-C589D2420556", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700\u00a0devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS).\n\nWhen forwarding-options sampling\u00a0is enabled, receipt\u00a0of any traffic destined to the Routing Engine (RE) by the PFE line card\u00a0leads to an FPC crash and restart, resulting in a Denial of Service (DoS). \n\nContinued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card.\n\n\nThis issue affects\u00a0Junos OS on SRX4700:\u00a0\n\n\n\n * from 24.4 before 24.4R1-S3, 24.4R2\n\n\nThis issue affects IPv4 and IPv6."}, {"lang": "es", "value": "Una vulnerabilidad de uso de recurso no inicializado en el Motor de Reenv\u00edo de Paquetes (PFE) de Juniper Networks Junos OS en dispositivos SRX4700 permite a un atacante no autenticado y basado en red causar una denegaci\u00f3n de servicio (DoS).\n\nCuando el muestreo de opciones de reenv\u00edo est\u00e1 habilitado, la recepci\u00f3n de cualquier tr\u00e1fico destinado al Motor de Enrutamiento (RE) por la tarjeta de l\u00ednea PFE provoca un fallo y reinicio de la FPC, lo que resulta en una denegaci\u00f3n de servicio (DoS).\n\nLa recepci\u00f3n y procesamiento continuos de cualquier tr\u00e1fico dirigido al RE por la tarjeta de l\u00ednea PFE crear\u00e1 una condici\u00f3n sostenida de denegaci\u00f3n de servicio (DoS) para la tarjeta de l\u00ednea PFE.\n\nEste problema afecta a Junos OS en SRX4700:\n\n* desde 24.4 anterior a 24.4R1-S3, 24.4R2\n\nEste problema afecta a IPv4 e IPv6."}], "id": "CVE-2025-59964", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "sirt@juniper.net", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "source": "sirt@juniper.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59964", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-09T18:59:53.970460Z", "version": "2.0.3"}}]}, "published": "2025-10-09T16:15:46.443", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://supportportal.juniper.net/JSA103153"}, {"source": "sirt@juniper.net", "tags": ["Technical Description"], "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/sampling-edit-forwarding-options.html"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "sirt@juniper.net", "type": "Secondary"}]}

{}

{"created": "2025-10-10T11:17:48.464835+00:00", "updated": "2025-10-10T11:17:48.464859+00:00", "vendors": ["juniper", "juniper$PRODUCT$junos_os", "juniper$PRODUCT$srx4700"]}