Cyber Resilience

CVE-2025-52953

Juniper Junos ≤ 21.2

Published
11 July 2025
Modified
17 June 2026
Patch / advisory
CVSS Score v4 7.1
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Amber
EPSS Score 0.0027 20th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-52953 is a high-severity Expected Behavior Violation (CWE-440) vulnerability in Juniper Junos. Its CVSS base score is 7.1 (High).

Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-6 (Security and Privacy Function Verification) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker sending a valid BGP UPDATE packet to cause a BGP session reset, resulting in a…

more

Denial of Service (DoS). Continuous receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue affects iBGP and eBGP and both IPv4 and IPv6 are affected by this vulnerability. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2, * from 24.4 before 24.4R1-S3, 24.4R2 Junos OS Evolved: * All versions before 22.2R3-S7-EVO, * from 22.4-EVO before 22.4R3-S7-EVO, * from 23.2-EVO before 23.2R2-S4-EVO, * from 23.4-EVO before 23.4R2-S4-EVO, * from 24.2-EVO before 24.2R2-EVO, * from 24.4-EVO before 24.4R1-S3-EVO, 24.4R2-EVO.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-60010Same product: Juniper Junos
CVE-2023-44204Same product: Juniper Junos
CVE-2023-22401Same product: Juniper Junos
CVE-2023-22398Same product: Juniper Junos
CVE-2026-33801Same product: Juniper Junos
CVE-2025-52949Same product: Juniper Junos
CVE-2024-30409Same product: Juniper Junos
CVE-2024-30386Same product: Juniper Junos
CVE-2025-21602Same product: Juniper Junos
CVE-2026-33780Same product: Juniper Junos

Affected Assets

juniper
junos
21.2, 21.4, 22.2, 22.4, 23.2 · ≤ 21.2
juniper
junos os evolved
22.2, 22.4, 23.2, 23.4, 24.2 · ≤ 22.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation directly checks whether implemented functions match their specifications.

Security function verification confirms that functions operate according to their defined expected behavior.

Requiring a documented security architecture and design reduces the chance that implementation deviates from intended behavior.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly enforce specification compliance and catch expected-behavior violations during development.

ID.IM-02 partial match
prevents

Security testing and exercises help discover behavior deviations before deployment.

ID.RA-01 partial match
prevents

Vulnerability identification can surface spec-violating flaws, while eliminating the weakness reduces some vulnerability backlog.

PR.PS-02 partial match
prevents

Routine software maintenance and patching can remediate discovered specification violations.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development and acceptance validates that functions behave as specified.

prevents

Secure development life cycle mandates verification against specifications, directly reducing expected-behavior violations.

prevents

Application security requirements explicitly define expected behavior that must be met.

prevents

Secure coding practices enforce adherence to functional specifications during implementation.

finds

Change management can catch specification deviations introduced by modifications.

none

Documented operating procedures reduce the chance that functions deviate from intended behavior.

References