CVE-2025-21590
Juniper Junos OS: Improper Isolation or Compartmentalization
As of , CVE-2025-21590 in Juniper Junos OS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 13 March 2025
- US federal deadline
- 3 April 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.02Higher than 77% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- Public exploit
- None foundNeither Metasploit nor Exploit-DB lists one.
- Fix
- Vendor advice: supportportal.juniper.netLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Juniper Junos OS contains an improper isolation or compartmentalization vulnerability. This vulnerability could allows a local attacker with high privileges to inject arbitrary code.
CISA's description
An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: * All versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2.
The CVE record's description, from juniper
- CVE published
- 12 March 2025
- Assigned by
- juniper
- CVSS
- 6.7 Medium (CVSS 4.0, from the CNA)
- CWE-653
- Improper Isolation or Compartmentalization
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Junos OS: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2023-36845EX Series and SRX Series PHP External Variable Modification | Juniper Junos OS | Patch this weekMetasploit module; EPSS 0.95 | 0.95 | ||
| CVE-2023-36844EX Series PHP External Variable Modification | Juniper Junos OS | Patch this weekEPSS 0.90 | 0.90 | ||
| CVE-2023-36846SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch this weekEPSS 0.93 | 0.93 | ||
| CVE-2023-36847EX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch this weekEPSS 0.83 | 0.83 | ||
| CVE-2020-1631Path Traversal | Juniper Junos OS | Patch soon | 0.05 | ||
| CVE-2023-36851SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch soon | 0.01 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org