kbrain

CVE-2025-60003

HIGH · CVSS 7.5EPSS 0.4%EU EUVD

A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer. This issue can only happen if one or both of the BGP peers of the receiving session are non-4-byte-AS capable as determined from the advertised capabilities during BGP session establishment. Junos OS and Junos OS Evolved default behavior is 4-byte-AS capable unless this has been specifically disabled by configuring: [ protocols bgp ... disable-4byte-as ] Established BGP sessions can be checked by executing: show bgp neighbor <IP address> | match "4 byte AS" This issue affects: Junos OS:  * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2; Junos OS Evolved:  * all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S5-EVO, * 23.4 versions before 23.4R2-S6-EVO, * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO.

Key facts

CVSS score
7.5 (v3.1)
Severity
HIGH
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-126
EPSS score
0.4% (34th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2026-2712)
Published
January 15, 2026
NVD last modified
June 17, 2026
Status
Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-2712 in the EU Vulnerability Database. Last updated in EUVD on January 15, 2026.

View on the EU Vulnerability Database

Affected products

  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos
  • juniper / junos os evolved
  • juniper / junos os evolved
  • juniper / junos os evolved
  • juniper / junos os evolved
  • juniper / junos os evolved

and 39 more…

Certified products that may be affected

6 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

See all 6 in the Security Certifications Explorer.

References

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain