CVE-2025-52981

Junos OS: SRX Series: Sequence of specific PIM packets causes a flowd crash

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX1600, SRX2300, SRX 4000 Series, and SRX5000 Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If a sequence of specific PIM packets is received, this will cause a flowd crash and restart. This issue affects Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S11, * 22.2 versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2. This is a similar, but different vulnerability than the issue reported as CVE-2024-47503, published in JSA88133.

Remediation

Solution:

  • The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S11, 22.2R3-S7, 22.4R3-S6, 23.2R2-S4, 23.4R2-S4, 24.2R2, 24.4R1, and all subsequent releases.

Workaround:

  • Minimize the PIM (Protocol Independent Multicast) session timeout value to be less than 5 seconds to avoid data session creation errors.

Category

8.7
CVSS
Severity: High
CVSS 4.0 •
CVSS 3.1 •
Vendor Advisory juniper.net
Affected: Juniper Networks Junos OS
Published at:
Updated at:

References

Link Tags
https://supportportal.juniper.net/JSA100087 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2025-52981?
CVE-2025-52981 has been scored as a high severity vulnerability.
How to fix CVE-2025-52981?
To fix CVE-2025-52981: The following software releases have been updated to resolve this specific issue: 21.2R3-S9, 21.4R3-S11, 22.2R3-S7, 22.4R3-S6, 23.2R2-S4, 23.4R2-S4, 24.2R2, 24.4R1, and all subsequent releases.
Is CVE-2025-52981 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-52981 is being actively exploited.
What software or system is affected by CVE-2025-52981?
CVE-2025-52981 affects Juniper Networks Junos OS.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.