CVE-2025-52952
Estado: AnalizadaAlta (7.1)—
An Out-of-bounds Write vulnerability in the connectivity fault management (CFM) daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS).
Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
This feature is not enabled by default.
Detalles técnicos trazas, registros y código del informe original
This issue affects Juniper Networks: Junos OS: * All versions before 22.2R3-S1, * from 22.4 before 22.4R2.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green
- Puntuación base: 7.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.29%
- Percentil entre todas las CVEs puntuadas: 20
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1210Exploitation of Remote Serviceslateral movement85 % - Impacto principal
T1499.004Application or System Exploitationimpact90 %
AV:A (adyacente) + PR:N permite T1210. Out-of-bounds Write en daemon CFM genera crash FPC = T1499.004 (Endpoint DoS), conf. alta por descripción explícita.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-787
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-52952",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-52952",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-07-11T20:10:43.269996Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "AUTOMATIC",
"baseScore": 7.1,
"Automatable": "YES",
"attackVector": "ADJACENT",
"baseSeverity": "HIGH",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "GREEN",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"vulnAvailabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "sirt@juniper.net",
"affectedData": [
{
"vendor": "Juniper Networks",
"modules": [
"pfe ukern",
"cfmman",
"cfmd"
],
"product": "Junos OS",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "22.2R3-S1",
"versionType": "semver"
},
{
"status": "affected",
"version": "22.4",
"lessThan": "22.4R2",
"versionType": "semver"
}
],
"platforms": [
"MX Series with MPC-BUILTIN",
"MPC1 through MPC9"
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2025-07-11T15:15:25.930",
"references": [
{
"url": "https://supportportal.juniper.net/JSA100058",
"tags": [
"Vendor Advisory"
],
"source": "sirt@juniper.net"
},
{
"url": "https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/cfm-configuring.html",
"tags": [
"Product"
],
"source": "sirt@juniper.net"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Out-of-bounds Write vulnerability in the connectivity fault management (CFM) daemon of Juniper Networks Junos OS on MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards allows an unauthenticated adjacent attacker to send a malformed packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS).\n\nContinued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nThis issue affects Juniper Networks:\nJunos OS:\n * All versions before 22.2R3-S1,\n * from 22.4 before 22.4R2.\n\n\nThis feature is not enabled by default."
},
{
"lang": "es",
"value": "Una vulnerabilidad de escritura fuera de los límites en el daemon de gestión de fallos de conectividad (CFM) de Juniper Networks Junos OS en la serie MX con tarjetas de línea MPC-BUILTIN, MPC1 a MPC9, permite que un atacante adyacente no autenticado envíe un paquete malformado al dispositivo, lo que provoca un bloqueo y reinicio de FPC, lo que resulta en una denegación de servicio (DoS). La recepción y el procesamiento continuos de este paquete crearán una condición de denegación de servicio (DoS) sostenida. Este problema afecta a Juniper Networks: Sistema operativo Junos: * Todas las versiones anteriores a 22.2R3-S1, * Desde la versión 22.4 hasta la 22.4R2. Esta función no está habilitada por defecto."
}
],
"lastModified": "2026-06-17T09:37:19.537",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92CA998E-CCA2-4629-ABAC-20F9C5E209CB",
"versionEndExcluding": "22.2"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "06156CD6-09D3-4A05-9C5E-BC64A70640F9"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E949B21B-AD62-4022-9088-06313277479E"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D862E6F-0D01-4B25-8340-888C30F75A2F"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F28F73E-8563-41B9-A313-BBAAD5B57A67"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E37D4694-C80B-475E-AB5B-BB431F59C5E1"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5EC0D2D2-4922-4675-8A2C-57A08D7BE334"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EC91F9D-DEDA-46B4-A39F-59A2CDB86C2E"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "591AA3E6-62A2-4A1A-A04C-E808F71D8B6E"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1379EF30-AF04-4F98-8328-52A631F24737"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28E42A41-7965-456B-B0AF-9D3229CE4D4C"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CB1A77D6-D3AD-481B-979C-8F778530B175"
},
{
"criteria": "cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A064B6B-A99B-4D8D-A62D-B00C7870BC30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:juniper:2x100ge_\\+_4x10ge_mpc5e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5679BED4-63FD-42B0-B308-A1206AFDE769"
},
{
"criteria": "cpe:2.3:h:juniper:2x100ge_\\+_4x10ge_mpc5eq:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5B0604D6-C3B9-428D-8D43-F48785480D04"
},
{
"criteria": "cpe:2.3:h:juniper:2x100ge_\\+_8x10ge_mpc4e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B65F6E81-C3D9-4703-8B14-6DC34B42603F"
},
{
"criteria": "cpe:2.3:h:juniper:32x10ge_mpc4e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A07C7D55-9D66-4BDB-A507-75B0331EFC6C"
},
{
"criteria": "cpe:2.3:h:juniper:6x40ge_\\+_24x10ge_mpc5e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "199CC7B8-2785-4F63-8EE8-EE7203B59E48"
},
{
"criteria": "cpe:2.3:h:juniper:6x40ge_\\+_24x10ge_mpc5eq:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BA76584A-E36E-41ED-9A3F-BD168725F85D"
},
{
"criteria": "cpe:2.3:h:juniper:mpc1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BE78E83B-343B-4904-A682-92B198DCEAE3"
},
{
"criteria": "cpe:2.3:h:juniper:mpc1_q:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A094D187-9140-41B9-AA0E-E4E584D0F2F0"
},
{
"criteria": "cpe:2.3:h:juniper:mpc1e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "333171A1-F3EA-45FB-8205-1871778D40DC"
},
{
"criteria": "cpe:2.3:h:juniper:mpc1e_q:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "40D03784-5211-4FD7-97AF-5909F54F28E6"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "92934C03-05EC-4AF2-B135-8FCBEAC3D149"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2_eq:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A3461DD8-F5B6-4C3D-AAA6-FAAAE88E4F85"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2_q:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "733273BB-8404-4285-A4A7-559EE21D90B9"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9BCA123A-6722-4E23-9BA8-83FB96AD3002"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2e_eq:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "97C89C5E-442B-4A3A-83D1-0DD006A4A79B"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2e_ng:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "278746EC-FA78-4DB7-8473-7351B0A78726"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2e_ng_q:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1E6D8DF3-0289-4D82-85C8-635E6F5CB584"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2e_p:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "DCF35F44-3B46-4050-B82F-D267DA3B9151"
},
{
"criteria": "cpe:2.3:h:juniper:mpc2e_q:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5FDB81B6-A211-477F-B0CD-902FE7B7BC13"
},
{
"criteria": "cpe:2.3:h:juniper:mpc3e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CB748146-5C97-4AE2-A0B9-DD96F1536990"
},
{
"criteria": "cpe:2.3:h:juniper:mpc3e-3d-ng:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4FB5503-9566-4122-B1D7-38068CB49D3A"
},
{
"criteria": "cpe:2.3:h:juniper:mpc3e-3d-ng-q:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "11E02146-9F55-447E-A41A-31D71B1A8E65"
},
{
"criteria": "cpe:2.3:h:juniper:mpc6e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "909367E9-8A24-4E52-9071-82BA921D2CC4"
},
{
"criteria": "cpe:2.3:h:juniper:mpc7e-10g:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C91895B5-1184-4E3D-A81C-CDBBAF5ADC73"
},
{
"criteria": "cpe:2.3:h:juniper:mpc7e-mrate:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FB488A7C-A9FE-44B9-828A-D7965083DDE8"
},
{
"criteria": "cpe:2.3:h:juniper:mpc8e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E401B681-AB69-4299-898B-7C81A288E6F2"
},
{
"criteria": "cpe:2.3:h:juniper:mpc9e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5909E1A6-32E9-4574-87D5-4B3948F24B25"
},
{
"criteria": "cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2FEF33EB-B2E0-42EF-A1BB-D41021B6D08F"
},
{
"criteria": "cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "27175D9A-CA2C-4218-8042-835E25DFCA43"
},
{
"criteria": "cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "00C7FC57-8ACF-45AA-A227-7E3B350FD24F"
},
{
"criteria": "cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F4A26704-A6A4-4C4F-9E12-A0A0259491EF"
},
{
"criteria": "cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "104858BD-D31D-40E0-8524-2EC311F10EAC"
},
{
"criteria": "cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B5E08E1E-0FE4-4294-9497-BBFFECA2A220"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "sirt@juniper.net"
}