CVE-2025-59958
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability. When an output firewall filter is configured with terms where the action is 'reject', matching packets are erroneously sent to the Routing Engine (RE) and processed there, consuming RE resources. Responses from the RE may reveal confidential information about the device. This issue only applies to firewall filters on WAN or revenue interfaces, not mgmt or lo0.
Risk Assessment
The risk includes exhaustion of routing engine resources, potentially leading to denial of service, and disclosure of confidential device information, compromising confidentiality.
Recommendation
It is recommended to upgrade Junos OS Evolved to version 22.4R3-EVO or 23.2R2-EVO, and review firewall filter configurations to avoid erroneous packet redirection to the RE.
Other vulnerabilities in Junos OS Evolved
See all- CVE-2026-101978High
An OS command injection vulnerability in the bootzd zero-touch provisioning daemon of Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.
- CVE-2026-101967High
An OS command injection vulnerability in the bootzd zero-touch provisioning daemon of Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted DHCP response.
- CVE-2026-102085Medium
An improper restriction of communication channel to intended endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause limited information disclosure and availability impact to the device. Due to wrong initialization, a process that should only communicate internally can be reached over the network via an open port, leading to inadvertent exposure and increased CPU cycles spent processing ingress packets.
- CVE-2026-102068High
A stack-based buffer overflow vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated remote attacker to trigger a kernel panic via a crafted TCP packet when key-chain authentication is used for BGP or LDP.
- CVE-2026-102045Medium
An Out-of-bounds Write vulnerability in lacpd of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to cause a denial of service via a crafted frame received on an LACP-enabled aggregated-Ethernet member port.
- CVE-2026-102023High
A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured.
- CVE-2026-102012High
A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved allows a remote unauthenticated attacker to cause a denial of service via a gRPC telemetry subscription request.
- CVE-2026-101985Medium
An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated IS-IS peer to cause a denial of service.
- CVE-2026-101966High
A use of externally-controlled format string vulnerability in the jti-dialoutd of Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener.
- CVE-2026-101965High
A use of externally-controlled format string vulnerability in the gRPC daemon of Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI service.
Original NVD description (English source)
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to cause impact to confidentiality and availability. When an output firewall filter is configured with one or more terms where the action is 'reject', packets matching these terms are erroneously sent to the Routing Engine (RE) and further processed there. Processing of these packets will consume limited RE resources. Also responses from the RE back to the source of this traffic could reveal confidential information about the affected device. This issue only applies to firewall filters applied to WAN or revenue interfaces, so not the mgmt or lo0 interface of the routing-engine, nor any input filters. This issue affects Junos OS Evolved on PTX Series: * all versions before 22.4R3-EVO, * 23.2 versions before 23.2R2-EVO.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS