CVE-2025-52982 Junos OS: MX Series: When specific SIP packets are processed the MS-MPC will crash

High 8.2 Published 11 Jul 2025 Updated 15 Jul 2025

An unauthenticated attacker can crash the MS-MPC on Juniper MX Series devices by sending specific SIP packets when multiple service sets are configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-52982?

CVE-2025-52982 is a high-severity denial of service vulnerability in Juniper Junos, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When an MX Series device with an MS-MPC is configured with two or more service sets which are both processing SIP calls, a specific sequence of call events will lead to a crash and restart of the MS-MPC. This issue affects Junos OS:

* all versions before 21.2R3-S9, * 21.4 versions from 21.4R1, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6.

As the MS-MPC is EoL after Junos OS 22.4, later versions are not affected.

This issue does not affect MX-SPC3 or SRX Series devices.

Weakness: CWE-404

Which versions are affected by CVE-2025-52982?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2025-52982?

No fix has been published for CVE-2025-52982 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-52982 being exploited?

There is no known exploitation of CVE-2025-52982 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-9x9c-4rh9-688v.