CVE-2025-52983 Junos OS: After removing ssh public key authentication root can still log in

High 8.6 Published 11 Jul 2025 Updated 26 Feb 2026

Attackers with private keys can log in as root on Junos OS VM Hosts even after public key removal, bypassing authentication controls.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-52983?

CVE-2025-52983 is a high-severity authentication bypass vulnerability in Juniper Junos, published on 11 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A UI Discrepancy for Security Feature

vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device.

On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS:

* all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2.

Weakness: CWE-446

Which versions are affected by CVE-2025-52983?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2025-52983?

No fix has been published for CVE-2025-52983 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-52983 being exploited?

There is no known exploitation of CVE-2025-52983 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-9cv5-8rg2-7cch.