CVE-2025-52952

Q: What is the severity of CVE-2025-52952?

CVE-2025-52952 has a CVSS score of 6.5 (MEDIUM). An out-of-bounds write vulnerability in Juniper Junos OS CFM daemon allows unauthenticated adjacent attackers to crash FPC cards by sending malformed packets, causing denial of service. This affects MX Series routers with specific MPC line cards running vulnerable Junos OS versions. The CFM feature must be enabled for exploitation.

6.5 MEDIUM

Denial of Service

📋 TL;DR

An out-of-bounds write vulnerability in Juniper Junos OS CFM daemon allows unauthenticated adjacent attackers to crash FPC cards by sending malformed packets, causing denial of service. This affects MX Series routers with specific MPC line cards running vulnerable Junos OS versions. The CFM feature must be enabled for exploitation.

💻 Affected Systems

Products:

Juniper Networks Junos OS on MX Series routers

Versions: All versions before 22.2R3-S1, and from 22.4 before 22.4R2

Operating Systems: Junos OS

Default Config Vulnerable: ✅ No

Notes: Only affects MX Series with MPC-BUILTIN, MPC1 through MPC9 line cards. CFM feature must be enabled and configured.

📦 What is this software?

Junos by Juniper

Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...

Learn more about Junos →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Sustained DoS condition with repeated FPC crashes, disrupting all network traffic through affected routers and potentially causing cascading network failures.

🟠

Likely Case

Intermittent FPC crashes causing temporary network outages until manual intervention or automatic restart completes.

🟢

If Mitigated

No impact if CFM is disabled or proper network segmentation prevents adjacent attackers from reaching vulnerable interfaces.

🌐 Internet-Facing: LOW - Requires adjacent network access, not directly internet exploitable.

🏢 Internal Only: MEDIUM - Internal attackers on same broadcast domain could exploit if CFM enabled.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malformed CFM packets to vulnerable interface from adjacent network position.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 22.2R3-S1 or 22.4R2 and later

Vendor Advisory: https://supportportal.juniper.net/JSA100058

Restart Required: Yes

Instructions:

1. Download appropriate Junos OS version from Juniper support portal. 2. Install using 'request system software add' command. 3. Reboot device after installation completes.

🔧 Temporary Workarounds

Disable CFM feature

all

Disable Connectivity Fault Management feature if not required

delete protocols oam ethernet connectivity-fault-management

Restrict CFM access

all

Apply firewall filters to limit CFM packet sources

set firewall family ethernet-switching filter BLOCK-CFM term 1 from protocol cfm
set firewall family ethernet-switching filter BLOCK-CFM term 1 then discard

🧯 If You Can't Patch

Disable CFM protocol entirely if not required for network operations
Implement strict network segmentation to prevent adjacent attackers from reaching vulnerable interfaces

🔍 How to Verify

Check if Vulnerable:

Check Junos OS version with 'show version' and verify CFM configuration with 'show configuration protocols oam ethernet connectivity-fault-management'

Check Version:

show version | match Junos

Verify Fix Applied:

Verify Junos OS version is 22.2R3-S1 or higher, or 22.4R2 or higher with 'show version'

📡 Detection & Monitoring

Log Indicators:

FPC crash messages in system logs
CFM protocol errors
Unexpected FPC restarts

Network Indicators:

Malformed CFM packets on network
Unusual CFM traffic patterns

SIEM Query:

source="junos" AND ("FPC crash" OR "CFM error" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2025-52952

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-787

EPSS Score: 0.04% exploit probability (9.8th percentile)

Published: July 11, 2025

Last Updated: January 26, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

Junos by Juniper

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable CFM feature

Restrict CFM access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities