CVE-2025-52980

Опубликовано: 11 июл. 2025

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

A Use of Incorrect Byte Ordering

vulnerability

in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart.

This issue affects eBGP and iBGP over IPv4 and IPv6.

This issue affects:

Junos OS:

22.1 versions from 22.1R1 before 22.2R3-S4,
22.3 versions before 22.3R3-S3,
22.4 versions before 22.4R3-S2,
23.2 versions before 23.2R2,
23.4 versions before 23.4R2.

Ссылки

https://supportportal.juniper.net/JSA100084
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:juniper:junos:22.1:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r3-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.1:r3-s3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.3:r3-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*

cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*

Одно из

cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*

cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*

cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*

cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*

cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*

EPSS

Процентиль: 20%

0.00065

Низкий

7.5 High

CVSS3

Дефекты

CWE-198

Связанные уязвимости

GHSA-p6jr-6crg-pfcj

CVSS3: 7.5

github

7 месяцев назад

A Use of Incorrect Byte Ordering vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS on SRX300 Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When a BGP update is received over an established BGP session which contains a specific, valid, optional, transitive path attribute, rpd will crash and restart. This issue affects eBGP and iBGP over IPv4 and IPv6. This issue affects: Junos OS: * 22.1 versions from 22.1R1 before 22.2R3-S4, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3-S2, * 23.2 versions before 23.2R2, * 23.4 versions before 23.4R2.

EPSS

Процентиль: 20%

0.00065

Низкий

7.5 High

CVSS3

Дефекты

CWE-198