CVE-2025-52961
BaseFortify
Publication date: 2025-10-09
Last updated on: 2025-10-14
Assigner: Juniper Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| juniper | junos_os_evolved | 23.2r1-evo |
| juniper | junos_os_evolved | 24.2 |
| juniper | junos_os_evolved | 24.4 |
| juniper | junos_os_evolved | 23.4 |
| juniper | junos_os_evolved | 24.4r1-s2-evo |
| juniper | junos_os_evolved | 23.2r2-s4-evo |
| juniper | junos_os_evolved | 24.2r2-evo |
| juniper | junos_os_evolved | 24.4r2-evo |
| juniper | junos_os_evolved | 23.4r2-s4-evo |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Uncontrolled Resource Consumption issue in the Connectivity Fault Management (CFM) daemon and manager of Juniper Networks Junos OS Evolved on certain PTX devices. An unauthenticated attacker on an adjacent device can send specific valid traffic that causes the CFM daemon's CPU usage to spike to 100% and the CFM manager's memory to leak. This leads to a crash and restart of the Flexible PIC Concentrator (FPC), resulting in a Denial-of-Service (DoS) condition that can be sustained by continued receipt of these packets.
How can this vulnerability impact me? :
The impact of this vulnerability is a Denial-of-Service (DoS) condition on affected Juniper devices. An attacker can cause the device's CPU to max out and memory to leak, eventually crashing and restarting critical components, which disrupts normal network operations and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring the memory usage of the cfmman process on the affected device. Use the command: show system processes node fpc<num> detail | match cfmman. Evaluate the RSS (Resident Set Size) number; if it is growing into gigabytes over time, it indicates a potential compromise due to this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
If you observe the cfmman memory usage growing excessively, consider restarting the device to temporarily clear the memory and mitigate the Denial-of-Service condition. Additionally, ensure your Junos OS Evolved version is updated to a fixed release version beyond the affected ones.