CVE-2025-60004
📋 TL;DR
An unauthenticated network attacker can cause a denial-of-service by sending a specific BGP EVPN update message to Juniper Junos OS and Junos OS Evolved devices, crashing the routing protocol daemon. This affects both iBGP and eBGP sessions over IPv4 and IPv6. Systems running affected versions of Junos OS and Junos OS Evolved are vulnerable even without BGP EVPN configuration.
💻 Affected Systems
- Juniper Junos OS
- Juniper Junos OS Evolved
📦 What is this software?
Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →Junos by Juniper
Junos OS is Juniper Networks' flagship network operating system running on enterprise routers, switches, security appliances, and data center infrastructure worldwide. Deployed across telecommunications providers, ISPs, cloud service providers, financial institutions, and large enterprises, Junos po...
Learn more about Junos →⚠️ Risk & Real-World Impact
Worst Case
Sustained attacks could cause repeated rpd crashes leading to extended network outages, routing instability, and potential cascading failures in critical infrastructure.
Likely Case
Intermittent routing daemon crashes causing temporary network disruptions, route flapping, and increased management overhead.
If Mitigated
With proper network segmentation and BGP session controls, impact is limited to isolated network segments with minimal service disruption.
🎯 Exploit Status
Exploitation requires sending specific BGP EVPN update over established BGP session. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Junos OS: 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, 24.4R2. Junos OS Evolved: 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S3-EVO, 24.4R2-EVO.
Vendor Advisory: https://supportportal.juniper.net/JSA103165
Restart Required: Yes
Instructions:
1. Download appropriate patch from Juniper support portal. 2. Apply patch using 'request system software add' command. 3. Reboot device to complete installation. 4. Verify patch installation with 'show version' command.
🔧 Temporary Workarounds
BGP Session Filtering
allConfigure BGP sessions to reject EVPN updates using route policies or prefix lists.
set policy-options policy-statement REJECT-EVPN term 1 from protocol evpn
set policy-options policy-statement REJECT-EVPN term 1 then reject
set protocols bgp group <group-name> import REJECT-EVPN
BGP Session Hardening
allImplement BGP session authentication and limit BGP peers to trusted sources only.
set protocols bgp group <group-name> authentication-key <key>
set protocols bgp group <group-name> neighbor <ip> description "Trusted Peer"
🧯 If You Can't Patch
- Implement strict BGP session controls to limit exposure to trusted peers only.
- Deploy network monitoring to detect abnormal BGP EVPN traffic and rpd crashes.
🔍 How to Verify
Check if Vulnerable:
Check current Junos version with 'show version' and compare against affected versions list.Check Version:
show versionVerify Fix Applied:
Verify installed version is patched with 'show version' and check for rpd stability after applying fix.📡 Detection & Monitoring
Log Indicators:
- rpd crash messages in system logs
- BGP session flaps
- EVPN update rejection logs
Network Indicators:
- Unusual BGP EVPN traffic patterns
- BGP session resets from untrusted sources
SIEM Query:
source="junos" AND ("rpd" AND "crash") OR ("BGP" AND "EVPN" AND "update")