Introduction
A single malformed BGP EVPN update can disrupt routing across a service provider or enterprise backbone and cause outages and traffic loss. CVE-2025-60004 is a critical flaw in Juniper Networks Junos OS and Junos OS Evolved that lets an unauthenticated attacker with BGP access remotely crash the routing protocol daemon (rpd). This post summarizes the vulnerability, the affected versions, how it works, and how to detect it.
About Juniper Networks: Juniper is a major networking vendor. Its Junos OS and Junos OS Evolved run routers and switches in service provider, data center, and enterprise environments worldwide, and its platforms are a core part of internet backbones, cloud networks, and large enterprise WANs.
Technical information
CVE-2025-60004 is classified as an improper check for unusual or exceptional conditions (CWE-754) in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved. When a vulnerable system receives a specially crafted BGP EVPN update message over an established BGP session, rpd crashes and restarts. Every routing protocol session drops and has to be re-established, which is the denial of service.
The issue is not limited to devices with an explicit BGP EVPN configuration. Any device that can receive BGP EVPN updates from peers is potentially vulnerable, over both iBGP and eBGP sessions and over both IPv4 and IPv6. The root cause is insufficient validation or error handling in the logic rpd uses to parse EVPN update messages. No public code snippets or proof of concept are available for this issue.
Detection methods
Detecting Junos OS vulnerabilities such as the one in advisory JSA103165 combines automated scanning with manual verification.
Automated scanning with Nessus:
Tenable's Nessus vulnerability scanner has a plugin (ID 269727) built to identify the vulnerability described in JSA103165. The plugin checks the version of Junos OS installed on the target device and flags the system as potentially affected if that version matches a known-vulnerable release. It may also assess specific configurations or settings that could indicate susceptibility.
Nessus relies on the version information the device reports about itself and does not exploit the vulnerability during the scan. It can identify potential vulnerabilities, but it cannot confirm that they are exploitable.
Manual verification:
Alongside automated scanning, these manual checks are recommended:
- Examine system logs for unusual activity or error messages that could suggest exploitation attempts.
- Analyze network traffic for patterns or anomalies that may indicate an attack targeting this vulnerability.
- Read Juniper's official documentation and advisories for the vulnerability's specifics and the recommended detection methods.
Indicators of compromise (IoCs):
The available sources do not list specific IoCs for this vulnerability. General signs of exploitation may include:
- Unexpected system reboots or crashes.
- Unusual spikes in network traffic.
- Unauthorized configuration changes.
Monitoring guidance:
To monitor for potential exploitation:
- Deploy intrusion detection systems (IDS) that can detect known attack signatures related to Junos OS vulnerabilities.
- Keep signatures in IDS and other security tools up to date so they recognize the latest threats.
- Schedule periodic vulnerability scans with tools like Nessus to find and fix vulnerabilities promptly.
Reference for detection: Nessus Plugin 269727
Affected systems and versions
The following Juniper products and versions are affected:
Junos OS:
- 23.4 versions from 23.4R2-S3 before 23.4R2-S5
- 24.2 versions from 24.2R2 before 24.2R2-S1
- 24.4 versions before 24.4R1-S3 and 24.4R2
Junos OS Evolved:
- 23.4-EVO versions from 23.4R2-S2-EVO before 23.4R2-S5-EVO
- 24.2-EVO versions from 24.2R2-EVO before 24.2R2-S1-EVO
- 24.4-EVO versions before 24.4R1-S3-EVO and 24.4R2-EVO
Vulnerability exposure: A device does not need a BGP EVPN configuration to be vulnerable. Exposure exists if its BGP peers can send it EVPN updates. Both iBGP and eBGP over IPv4 and IPv6 are affected.
Vendor security history
Juniper Networks has a history of BGP and EVPN-related vulnerabilities, such as CVE-2025-52949 and CVE-2025-52958, both of which involve rpd crashing on malformed BGP messages. Juniper typically issues advisories promptly and works with security vendors on detection plugin updates. It runs a dedicated security advisory portal and regularly updates customers on patch availability and mitigation guidance.
