Cyber Resilience

CVE-2025-60010

Juniper Junos ≤ 22.4

Published
09 October 2025
Modified
23 January 2026
Patch / advisory
View advisory
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
EPSS Score 0.0016 6th percentile
Risk Priority 31 floored blend · peak EPSS

Summary

CVE-2025-60010 is a medium-severity Not Using Password Aging (CWE-262) vulnerability in Juniper Junos. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. Affected devices allow logins by users for whom…

more

the RADIUS server has responded with a reject and required the user to change the password as their password was expired. Therefore the policy mandating the password change is not enforced. This does not allow users to login with a wrong password, but only with the correct but expired one. This issue affects: Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S3, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S4-EVO, * 23.4 versions before 23.4R2-S5-EVO, * 24.2 versions before 24.2R2-S1-EVO, * 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO.

CWE(s)
CWE-262

Related Threats

MITRE ATT&CK Enterprise Techniques

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1110.001 Password Guessing Credential Access
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
attack.mitre.org →
T1110.003 Password Spraying Credential Access
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.
attack.mitre.org →
T1110.004 Credential Stuffing Credential Access
Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.
attack.mitre.org →
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-44204Same product: Juniper Junos
CVE-2023-22401Same product: Juniper Junos
CVE-2023-22398Same product: Juniper Junos
CVE-2026-33801Same product: Juniper Junos
CVE-2025-52949Same product: Juniper Junos
CVE-2024-30409Same product: Juniper Junos
CVE-2024-30386Same product: Juniper Junos
CVE-2025-21602Same product: Juniper Junos
CVE-2026-33780Same product: Juniper Junos
CVE-2024-21613Same product: Juniper Junos

Affected Assets

juniper
junos
22.4, 23.2, 23.4, 24.2, 24.4 · ≤ 22.4
juniper
junos os evolved
22.4, 23.2, 23.4, 24.2, 24.4 · ≤ 22.4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match

IA-5 requires management of authenticators including periodic password changes, directly preventing absence of aging mechanisms.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-01 mostly match
prevents

Credential management explicitly includes lifecycle controls such as password aging and expiration.

PR.AA-03 partial match
prevents

Authentication policy enforcement can include password-aging rules even though the example text only cites strength.

PR.AA-05 partial match
prevents

Access-authorization policy can embed password-aging requirements as part of entitlement rules.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.17 Authentication information partial match
degrades

Requires policies and procedures for managing authentication information including password lifecycle.

A.8.5 Secure authentication partial match
degrades

Specifies secure authentication mechanisms that commonly include password aging and rotation requirements.

A.5.18 Access rights none match
none

Defines access rights provisioning but does not mandate password aging rules.

References