CVE-2025-52948 Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled
An attacker can crash the system by sending specific traffic patterns when packet capturing is enabled, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-52948?
CVE-2025-52948 is a high-severity vulnerability in Juniper Junos, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Handling of Exceptional Conditions vulnerability in Berkeley Packet Filter (BPF) processing of Juniper Networks Junos OS allows an attacker, in rare cases, sending specific, unknown traffic patterns to cause the FPC and system to crash and restart.
BPF provides a raw interface to data link layers in a protocol independent fashion. Internally within the Junos kernel, due to a rare timing issue (race condition), when a BPF instance is cloned, the newly created interface causes an internal structure leakage, leading to a system crash. The precise content and timing of the traffic patterns is indeterminate, but has been seen in a lab environment multiple times.
This issue is more likely to occur when packet capturing is enabled. See required configuration below.
This issue affects Junos OS:
* all versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R1-S1, 24.2R2.
Weakness: CWE-755
Which versions are affected by CVE-2025-52948?
It affects 1 product.
Products include Juniper Junos.
How do I fix CVE-2025-52948?
No fix has been published for CVE-2025-52948 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-52948 being exploited?
There is no known exploitation of CVE-2025-52948 in the wild and no public exploit code.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-996g-m3p2-jr77.