CVE-2025-52963

An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an interface, leading to a Denial-of-Service. Users with "view" permissions can run a specific request interface command which allows the user to shut down the interface. This issue affects Junos OS: * All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S11, * from 22.2 before 22.2R3-S7, * from 22.4 before 22.4R3-S7, * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S3, 24.4R2.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA100078

Configurations

No configuration.

History

15 Jul 2025, 13:14

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de control de acceso inadecuado en la interfaz de usuario (IU) de Juniper Networks Junos OS permite a un atacante local con pocos privilegios desactivar una interfaz, lo que provoca una denegación de servicio (DPS). Los usuarios con permisos de vista pueden ejecutar un comando de solicitud de interfaz específico que permite desactivarla. Este problema afecta a Junos OS: * Todas las versiones anteriores a 21.2R3-S9, * desde 21.4 hasta 21.4R3-S11, * desde 22.2 hasta 22.2R3-S7, * desde 22.4 hasta 22.4R3-S7, * desde 23.2 hasta 23.2R2-S4, * desde 23.4 hasta 23.4R2-S5, * desde 24.2 hasta 24.2R2-S1, * desde 24.4 hasta 24.4R1-S3, 24.4R2.

11 Jul 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 15:15

Updated : 2025-07-15 13:14

NVD link : CVE-2025-52963

Mitre link : CVE-2025-52963

CVE.ORG link : CVE-2025-52963

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-52963", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-11T15:15:26.817", "references": [{"url": "https://supportportal.juniper.net/JSA100078", "source": "sirt@juniper.net"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an interface, leading to a Denial-of-Service.\n\nUsers with \"view\" permissions can run a specific\u00a0request interface\u00a0command\u00a0which allows the user to shut down the interface.\nThis issue affects Junos OS:\u00a0\n\n\n * All versions before 21.2R3-S9, \n * from 21.4 before 21.4R3-S11, \n * from 22.2 before 22.2R3-S7,\n * from 22.4 before 22.4R3-S7, \n * from 23.2 before 23.2R2-S4,\n * from 23.4 before 23.4R2-S5,\u00a0\u00a0\n * from 24.2 before 24.2R2-S1, \n * from 24.4 before 24.4R1-S3, 24.4R2."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso inadecuado en la interfaz de usuario (IU) de Juniper Networks Junos OS permite a un atacante local con pocos privilegios desactivar una interfaz, lo que provoca una denegaci\u00f3n de servicio (DPS). Los usuarios con permisos de vista pueden ejecutar un comando de solicitud de interfaz espec\u00edfico que permite desactivarla. Este problema afecta a Junos OS: * Todas las versiones anteriores a 21.2R3-S9, * desde 21.4 hasta 21.4R3-S11, * desde 22.2 hasta 22.2R3-S7, * desde 22.4 hasta 22.4R3-S7, * desde 23.2 hasta 23.2R2-S4, * desde 23.4 hasta 23.4R2-S5, * desde 24.2 hasta 24.2R2-S1, * desde 24.4 hasta 24.4R1-S3, 24.4R2."}], "lastModified": "2025-07-15T13:14:49.980", "sourceIdentifier": "sirt@juniper.net"}