CVE-2025-52984 Null dereference in Junos OS

High 8.2 Published 11 Jul 2025 Updated 15 Jul 2025

An unauthenticated attacker can crash the routing daemon by querying a static route with a reject next-hop, causing denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-52984?

CVE-2025-52984 is a high-severity vulnerability in Juniper Junos, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause impact to the availability of the device.

When static route points to a reject next hop and a gNMI query is processed for that static route, rpd crashes and restarts.

This issue affects:

Junos OS: * all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S10, * 22.2 versions before 22.2R3-S6, * 22.4 versions before 22.4R3-S6, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R1-S2, 24.2R2;

Junos OS Evolved:

* all versions before 22.4R3-S7-EVO, * 23.2-EVO

versions before 23.2R2-S3-EVO, * 23.4-EVO versions before 23.4R2-S4-EVO, * 24.2-EVO versions before 24.2R2-EVO.

Weakness: CWE-476

Which versions are affected by CVE-2025-52984?

It affects 2 products.

Products include Juniper Junos, Juniper Junos Os Evolved.

How do I fix CVE-2025-52984?

No fix has been published for CVE-2025-52984 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-52984 being exploited?

There is no known exploitation of CVE-2025-52984 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-cf83-h37v-rjpm.