Juniper Junos OS Vulnerability Exploited, CISA Warns

CISA has warned about a Junos OS vulnerability (CVE-2025-21590) in Juniper Networks. This flaw allows high-privileged local attackers to inject code, risking system compromise.

It stems from weak security restrictions in the kernel but cannot be exploited via the Junos CLI, limiting attack vectors to those with shell access.

Juniper Junos OS Vulnerability

Juniper Networks released advisories JSA93446 and JSA5385 to address the CVE-2025-21590 vulnerability. Users are advised to upgrade Junos OS as outlined in JSA93446, which includes patches and updated anti-malware signatures.

Mandiant, a Google Cloud Security unit, linked a cyber espionage campaign to the China-backed group UNC3886. The attackers targeted outdated Juniper MX routers, injecting malicious code into system processes to bypass Junos OS’s Veriexec security feature.

Juniper Vulnerability Mitigation Steps

Upgrade Routers: Mandiant advises upgrading all Juniper routers to supported versions with the latest security patches to prevent known exploits.

Strengthen Security: Implement multi-factor authentication and enforce strict role-based access controls to minimize unauthorized access risks.

CISA Alert: CVE-2025-21590 has been added to CISA’s Known Exploited Vulnerabilities Catalog. Federal agencies must address this by April 3, 2025, as required by BOD 22-01.

Urgent Action: CISA urges all organizations, including non-federal entities, to prioritize these updates to reduce cyberattack risks.

Juniper Guidance: Updated software releases are available, but end-of-life versions may lack support. Restrict shell access to trusted users and apply vendor-recommended mitigations.

By following these steps, organizations can better protect their systems and data.