CVE-2025-52984

EUVD-2025-21146

11.07.2025, 16:15

A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause impact to the availability of the device.

When static route points to a reject next hop and a gNMI query is processed for that static route, rpd crashes and restarts.

This issue affects:

Junos OS:   *  all versions before 21.2R3-S9,
  *  21.4 versions before 21.4R3-S10, 
  *  22.2 versions before 22.2R3-S6,
  *  22.4 versions before 22.4R3-S6,
  *  23.2 versions before 23.2R2-S3,
  *  23.4 versions before 23.4R2-S4,
  *  24.2 versions before 24.2R1-S2, 24.2R2;


Junos OS Evolved:



  *  all versions before 22.4R3-S7-EVO,
  *  23.2-EVO 

 versions before 23.2R2-S3-EVO,
  *  23.4-EVO versions before 23.4R2-S4-EVO,
  *  24.2-EVO versions before 24.2R2-EVO.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
juniper	CNA	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 14%

Affected Products (NVD)

Vendor	Product	Version
juniper	junos	𝑥 < 21.2
juniper	junos	21.2
juniper	junos	21.2:r1
juniper	junos	21.2:r1-s1
juniper	junos	21.2:r1-s2
juniper	junos	21.2:r2
juniper	junos	21.2:r2-s1
juniper	junos	21.2:r2-s2
juniper	junos	21.2:r3
juniper	junos	21.2:r3-s1
juniper	junos	21.2:r3-s2
juniper	junos	21.2:r3-s3
juniper	junos	21.2:r3-s4
juniper	junos	21.2:r3-s5
juniper	junos	21.2:r3-s6
juniper	junos	21.2:r3-s7
juniper	junos	21.2:r3-s8
juniper	junos	21.4
juniper	junos	21.4:r1
juniper	junos	21.4:r1-s1
juniper	junos	21.4:r1-s2
juniper	junos	21.4:r2
juniper	junos	21.4:r2-s1
juniper	junos	21.4:r2-s2
juniper	junos	21.4:r3
juniper	junos	21.4:r3-s1
juniper	junos	21.4:r3-s10
juniper	junos	21.4:r3-s2
juniper	junos	21.4:r3-s3
juniper	junos	21.4:r3-s4
juniper	junos	21.4:r3-s5
juniper	junos	21.4:r3-s6
juniper	junos	21.4:r3-s7
juniper	junos	21.4:r3-s8
juniper	junos	21.4:r3-s9
juniper	junos	22.2
juniper	junos	22.2:r1
juniper	junos	22.2:r1-s1
juniper	junos	22.2:r1-s2
juniper	junos	22.2:r2
juniper	junos	22.2:r2-s1
juniper	junos	22.2:r2-s2
juniper	junos	22.2:r3
juniper	junos	22.2:r3-s1
juniper	junos	22.2:r3-s2
juniper	junos	22.2:r3-s3
juniper	junos	22.2:r3-s4
juniper	junos	22.2:r3-s5
juniper	junos	22.4
juniper	junos	22.4:r1
juniper	junos	22.4:r1-s1
juniper	junos	22.4:r1-s2
juniper	junos	22.4:r2
juniper	junos	22.4:r2-s1
juniper	junos	22.4:r2-s2
juniper	junos	22.4:r3
juniper	junos	22.4:r3-s1
juniper	junos	22.4:r3-s2
juniper	junos	22.4:r3-s3
juniper	junos	22.4:r3-s4
juniper	junos	22.4:r3-s5
juniper	junos	23.2
juniper	junos	23.2:r1
juniper	junos	23.2:r1-s1
juniper	junos	23.2:r1-s2
juniper	junos	23.2:r2
juniper	junos	23.2:r2-s1
juniper	junos	23.2:r2-s2
juniper	junos	23.4
juniper	junos	23.4:r1
juniper	junos	23.4:r1-s1
juniper	junos	23.4:r1-s2
juniper	junos	23.4:r2
juniper	junos	23.4:r2-s1
juniper	junos	23.4:r2-s2
juniper	junos	23.4:r2-s3
juniper	junos	24.2
juniper	junos	24.2:r1
juniper	junos	24.2:r1-s1
juniper	junos	24.2:r2
juniper	junos_os_evolved	𝑥 < 22.4
juniper	junos_os_evolved	22.4
juniper	junos_os_evolved	22.4:r1
juniper	junos_os_evolved	22.4:r1-s1
juniper	junos_os_evolved	22.4:r1-s2
juniper	junos_os_evolved	22.4:r2
juniper	junos_os_evolved	22.4:r2-s1
juniper	junos_os_evolved	22.4:r2-s2
juniper	junos_os_evolved	22.4:r3
juniper	junos_os_evolved	22.4:r3-s1
juniper	junos_os_evolved	22.4:r3-s2
juniper	junos_os_evolved	22.4:r3-s3
juniper	junos_os_evolved	22.4:r3-s4
juniper	junos_os_evolved	22.4:r3-s5
juniper	junos_os_evolved	22.4:r3-s6
juniper	junos_os_evolved	23.2
juniper	junos_os_evolved	23.2:r1
juniper	junos_os_evolved	23.2:r1-s1
juniper	junos_os_evolved	23.2:r1-s2
juniper	junos_os_evolved	23.2:r2
juniper	junos_os_evolved	23.2:r2-s1
juniper	junos_os_evolved	23.2:r2-s2
juniper	junos_os_evolved	23.4
juniper	junos_os_evolved	23.4:r1
juniper	junos_os_evolved	23.4:r1-s1
juniper	junos_os_evolved	23.4:r1-s2
juniper	junos_os_evolved	23.4:r2
juniper	junos_os_evolved	23.4:r2-s1
juniper	junos_os_evolved	23.4:r2-s2
juniper	junos_os_evolved	23.4:r2-s3
juniper	junos_os_evolved	24.2
juniper	junos_os_evolved	24.2:r1
juniper	junos_os_evolved	24.2:r1-s2

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://supportportal.juniper.net/JSA100090