CVE-2025-52951

A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface. Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria. This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability. This issue affects Junos OS: * all versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S2, 24.4R2. This is a more complete fix for previously published CVE-2024-21607 (JSA75748).

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA100055

Configurations

No configuration.

History

15 Jul 2025, 15:15

Type	Values Removed	Values Added
Summary	(en) A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic to an interface to effectively bypass any firewall filtering configured on the interface. Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface. This issue affects Junos OS: * all versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S2, 24.4R2. This is a more complete fix for previously published CVE-2024-21607 (JSA75748).	(en) A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface. Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria. This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability. This issue affects Junos OS: * all versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S2, 24.4R2. This is a more complete fix for previously published CVE-2024-21607 (JSA75748).

15 Jul 2025, 13:14

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de fallo del mecanismo de protección en el procesamiento del filtro del kernel de Junos OS de Juniper Networks permite a un atacante que envía tráfico IPv6 a una interfaz eludir eficazmente cualquier filtrado del firewall configurado en ella. Debido a un problema con el procesamiento del filtro del kernel de Junos OS, no se admite la coincidencia "payload-protocol", lo que provoca que cualquier término que la contenga acepte todos los paquetes sin realizar ninguna otra acción. En esencia, estos términos del filtro del firewall se procesaban como una "aceptación" para todo el tráfico de la interfaz. Este problema afecta a Junos OS: * todas las versiones anteriores a 21.2R3-S9, * desde la versión 21.4 hasta la 21.4R3-S11, * desde la versión 22.2 hasta la 22.2R3-S7, * desde la versión 22.4 hasta la 22.4R3-S7, * desde la versión 23.2 hasta la 23.2R2-S4, * desde la versión 23.4 hasta la 23.4R2-S5, * desde la versión 24.2 hasta la 24.2R2-S1, * desde la versión 24.4 hasta la 24.4R1-S2, 24.4R2. Esta es una corrección más completa para la CVE-2024-21607 (JSA75748) publicada anteriormente.

11 Jul 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 15:15

Updated : 2025-07-15 15:15

NVD link : CVE-2025-52951

Mitre link : CVE-2025-52951

CVE.ORG link : CVE-2025-52951

JSON object : View

Products Affected

No product.

CWE

CWE-693

Protection Mechanism Failure

5.8 /10