CVE-2025-60007

#!/bin/bash # CVE-2025-60007 PoC - Juniper Junos OS chassisd NULL Pointer Dereference # Requirements: Local low-privilege access to Junos OS device echo "[*] CVE-2025-60007 - Juniper Junos OS chassisd DoS PoC" echo "[*] Target: Junos OS on MX, SRX, EX Series" echo "" # Check if we have CLI access if ! command -v cli &> /dev/null; then echo "[-] Error: Junos CLI (cli) not found. This PoC must run on Junos OS." exit 1 fi # Attempt to trigger the vulnerability # Note: The exact parameters are vendor-confidential # This demonstrates the attack vector echo "[+] Attempting to trigger chassisd vulnerability..." echo "[!] This may cause system instability" # Potential trigger command patterns (actual exploit requires specific parameters) # These are placeholder patterns based on the vulnerability description # Pattern 1: Show chassis with specific options cli -c "show chassis ?" 2>/dev/null || echo "[i] CLI access limited" # Pattern 2: Monitor the chassisd process cli -c "show system processes chassisd" 2>/dev/null || echo "[i] Cannot query chassisd" # Check chassisd status before and after echo "" echo "[*] Checking chassisd process status..." cli -c "show system processes extended" 2>/dev/null | grep -i chassisd || echo "[i] Cannot verify chassisd" echo "" echo "[*] PoC execution completed" echo "[!] If vulnerable, chassisd may have crashed and restarted"

{"cve": {"id": "CVE-2025-60007", "sourceIdentifier": "[email protected]", "published": "2026-01-15T21:16:03.780", "lastModified": "2026-03-16T19:16:14.107", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service (DoS).\n\n\nWhen a user executes the 'show chassis' command with specifically crafted options, chassisd will crash and restart. Due to this all components but the Routing Engine (RE) in the chassis are reinitialized, which leads to a complete service outage, which the system automatically recovers from.\n\n\n\nThis issue affects:\n\nJunos OS on MX, SRX and EX Series, except MX10000 Series and MX304: \n\n\n\n * all versions before 22.4R3-S8,\n * 23.2 versions before 23.2R2-S5,\n * 23.4 versions before 23.4R2-S6,\n * 24.2 versions before 24.2R2-S2,\n * 24.4 versions before 24.4R2."}, {"lang": "es", "value": "Una vulnerabilidad de desreferencia de puntero nulo en el demonio de chasis (chassisd) de Juniper Networks Junos OS en las series MX, SRX y EX permite a un atacante local con privilegios bajos causar una denegación de servicio (DoS).\n\nCuando un usuario ejecuta el comando 'show chassis' con opciones específicamente diseñadas, chassisd se bloqueará y reiniciará. Debido a esto, todos los componentes excepto el Routing Engine (RE) en el chasis se reinicializan, lo que lleva a una interrupción completa del servicio, de la cual el sistema se recupera automáticamente.\n\nEste problema afecta:\n\nJunos OS en las series MX, SRX y EX:\n\n * todas las versiones anteriores a 22.4R3-S8,\n * versiones 23.2 anteriores a 23.2R2-S5,\n * versiones 23.4 anteriores a 23.4R2-S6,\n * versiones 24.2 anteriores a 24.2R2-S2,\n * versiones 24.4 anteriores a 24.4R2."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "AUTOMATIC", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*", "versionEndExcluding": "22.4", "matchCriteriaId": "57F66641-003B-49D6-A9B9-AB300CFE3C93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*", "matchCriteriaId": "1379EF30-AF04-4F98-8328-52A631F24737"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*", "matchCriteriaId": "28E42A41-7965-456B-B0AF-9D3229CE4D4C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "CB1A77D6-D3AD-481B-979C-8F778530B175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "3A064B6B-A99B-4D8D-A62D-B00C7870BC30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*", "matchCriteriaId" ... (truncated)