CVE-2025-52947

Estado: AnalizadaAlta (7.1)—

An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platforms allows an attacker to crash the Forwarding Engine Board (FEB) by flapping an interface, leading to a Denial of Service (DoS).

On ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096 devices, FEB0 will crash when the primary path port of the L2 circuit IGP (Interior Gateway Protocol) on the local device goes down. This issue is seen only when 'hot-standby' mode is configured for the L2 circuit.

This issue affects Junos OS on ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096:

Detalles técnicos trazas, registros y código del informe original

  *  all versions before 21.2R3-S9.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:M/U:Green
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.28%
Percentil entre todas las CVEs puntuadas: 19
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement75 %
Impacto principalT1499.004 Application or System Exploitationimpact85 %

Vulnerabilidad en enrutador remoto (Junos OS) accesible en red adyacente (AV:A). Explotación mediante manipulación de interfaz (interface flapping) causa crash del FEB, resultando en DoS completo del dispositivo.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Filter Network Traffic Disable or Remove Feature or Program

Tecnologías afectadas (1)

Juniper — Junos

CWE

CWE-755

Referencias

https://supportportal.juniper.net/JSA100051

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-52947",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-52947",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-11T15:25:03.681598Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "AUTOMATIC",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:M/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "21.2R3-S9",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "ACX1000",
            "ACX1100",
            "ACX2000",
            "ACX2100",
            "ACX2200",
            "ACX4000",
            "ACX5048",
            "ACX5096"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-11T15:15:25.000",
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA100051",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@juniper.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platforms allows an attacker to crash the Forwarding Engine Board (FEB) by flapping an interface, leading to a Denial of Service (DoS).\n\nOn ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096 devices, FEB0 will crash when the primary path port of the L2 circuit IGP (Interior Gateway Protocol) on the local device goes down. This issue is seen only when 'hot-standby' mode is configured for the L2 circuit.\n\nThis issue affects Junos OS on ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096: \n\n\n\n  *  all versions before 21.2R3-S9."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Manejo Inadecuado de Condiciones Excepcionales en el procesamiento de rutas de Juniper Networks Junos OS en plataformas específicas de la serie ACX al final de su vida útil (EOL) permite a un atacante bloquear la placa del motor de reenvío (FEB) mediante la fluctuación de una interfaz, lo que provoca una denegación de servicio (DoS). En los dispositivos ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048 y ACX5096, FEB0 se bloquea cuando falla el puerto de ruta principal del protocolo de puerta de enlace interior (IGP) del circuito L2 del dispositivo local. Este problema solo se observa cuando se configura el modo de espera activa para el circuito L2. Este problema afecta a Junos OS en ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048 y ACX5096: * todas las versiones anteriores a 21.2R3-S9."
    }
  ],
  "lastModified": "2026-06-17T09:37:18.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "331C0F12-D9B9-483B-9EF0-28E48ED8346D",
              "versionEndExcluding": "21.2"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "216E7DDE-453D-481F-92E2-9F8466CDDA3F"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A52AF794-B36B-43A6-82E9-628658624B0A"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3998DC76-F72F-4452-9150-652140B113EB"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36ED4552-2420-45F9-B6E4-6DA2B2B12870"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C28A14E7-7EA0-4757-9764-E39A27CFDFA5"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A43752D-A4AF-4B4E-B95B-192E42883A5B"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42986538-E9D0-4C2E-B1C4-A763A4EE451B"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE22CA01-EA7E-4EE5-B59F-EE100688C1DA"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E596ABD9-6ECD-48DC-B770-87B7E62EA345"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71745D02-D226-44DC-91AD-678C85F5E6FC"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39E44B09-7310-428C-8144-AE9DB0484D1F"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53938295-8999-4316-9DED-88E24D037852"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2307BF56-640F-49A8-B060-6ACB0F653A61"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "737DDF96-7B1D-44E2-AD0F-E2F50858B2A3"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35E0BB39-18AE-4FAD-A528-FDFF6222DDE5"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:21.2:r3-s8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DCAA120-20A2-43D8-87D3-716225CE233F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:acx1000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AF19CB03-4A42-48BC-A6E1-A6F56D40F422"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx1100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "648CB4A2-05FA-4445-BB4F-F9285A8E8A5D"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx2000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "90339191-4DE3-4116-8CEC-C5440D063CEE"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx2100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E9F5683A-7DCC-4691-AD3A-F2B66684DA9C"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx2200:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "154658D0-FE3E-43C1-8A4D-CAF67C9BCD98"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx4000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "76E2CDA9-2379-482C-B509-D527AFE2C7D5"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx5048:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3F8DB691-C9F4-4084-8563-642A2F63DA86"
            },
            {
              "criteria": "cpe:2.3:h:juniper:acx5096:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "44B58F51-4F0D-40BD-A90F-226A26F4646E"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}