CVE-2025-21601

An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) ofJuniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows anunauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive. 

Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition.




This issue affects Junos OS:



  *  All versions before 21.4R3-S9,
  *  from 22.2 before 22.2R3-S5,
  *  from 22.4 before 22.4R3-S4,
  *  from 23.2 before 23.2R2-S3,
  *  from 23.4 before 23.4R2-S3,
  *  from 24.2 before 24.2R1-S1, 24.2R2.


An indicator of compromise is to review the CPU % of the httpd process in the CLI:
e.g.
show system processes extensive | match httpd PID nobody    52   0   20M  191M select  2  0:01  80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator