Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a persistent backdoor

Summary

CVE	CVE-2025-59957
State	PUBLISHED
Assigner	juniper
Source Priority	CVE Program / NVD first with legacy fallback
Published	2025-10-09 16:15:45 UTC
Updated	2026-10-08 13:10:00 UTC
Description	An Origin Validation Error vulnerability in an insufficient protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't configured with a root password, an attacker can modify a specific file. It's contents will be added to the Junos configuration of the device without being visible. This allows for the addition of any configuration unknown to the actual operator, which includes users, IP addresses and other configuration which could allow unauthorized access to the device. This exploit is persistent across reboots and even zeroization. The indicator of compromise is a modified /etc/config/<platform>-defaults[-flex].conf file. Review that file for unexpected configuration statements, or compare it to an unmodified version which can be extracted from the original Juniper software image file. For details on the extraction procedure please contact Juniper Technical Assistance Center (JTAC). To restore the device to a trusted initial configuration the system needs to be reinstalled from physical media. This issue affects Junos OS on EX4600 Series and QFX5000 Series: * All versions before 21.4R3, * 22.2 versions before 22.2R3-S3.

Risk And Classification

Primary CVSS: v4.0 7 HIGH from [email protected]

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:H/U:X

EPSS: 0.001840000 probability, percentile 0.073330000 (date 2026-10-08)

Problem Types: CWE-346 | CWE-346 CWE-346 Origin Validation Error

Version	Source	Type	Score	Severity	Vector
4.0	[email protected]	Secondary	7	HIGH	`CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	7	HIGH	`CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/...`
3.1	[email protected]	Secondary	6.8	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	CVSS	6.8	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

CVSS v4.0 Breakdown

Attack Vector

Physical

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Confidentiality

High

Integrity

High

Availability

High

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:H/U:X

CVSS v3.1 Breakdown

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Juniper	Ex4600	-	All	All	All
Hardware	Juniper	Ex4650	-	All	All	All
Operating System	Juniper	Junos	All	All	All	All
Operating System	Juniper	Junos	21.4	-	All	All
Operating System	Juniper	Junos	21.4	r1	All	All
Operating System	Juniper	Junos	21.4	r1-s1	All	All
Operating System	Juniper	Junos	21.4	r1-s2	All	All
Operating System	Juniper	Junos	21.4	r2	All	All
Operating System	Juniper	Junos	21.4	r2-s1	All	All
Operating System	Juniper	Junos	21.4	r2-s2	All	All
Operating System	Juniper	Junos	22.2	-	All	All
Operating System	Juniper	Junos	22.2	r1	All	All
Operating System	Juniper	Junos	22.2	r1-s1	All	All
Operating System	Juniper	Junos	22.2	r1-s2	All	All
Operating System	Juniper	Junos	22.2	r2	All	All
Operating System	Juniper	Junos	22.2	r2-s1	All	All
Operating System	Juniper	Junos	22.2	r2-s2	All	All
Operating System	Juniper	Junos	22.2	r3	All	All
Operating System	Juniper	Junos	22.2	r3-s1	All	All
Operating System	Juniper	Junos	22.2	r3-s2	All	All
Hardware	Juniper	Qfx5110	-	All	All	All
Hardware	Juniper	Qfx5120	-	All	All	All
Hardware	Juniper	Qfx5130	-	All	All	All
Hardware	Juniper	Qfx5200	-	All	All	All
Hardware	Juniper	Qfx5210	-	All	All	All
Hardware	Juniper	Qfx5220	-	All	All	All
Hardware	Juniper	Qfx5230-64cd	-	All	All	All
Hardware	Juniper	Qfx5240	-	All	All	All
Hardware	Juniper	Qfx5241	-	All	All	All
Hardware	Juniper	Qfx5700	-	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Juniper Networks	Junos OS	affected 21.4R3 semver	EX4600, QFX5000
CNA	Juniper Networks	Junos OS	affected 22.2 22.2R3-S3 semver	EX4600, QFX5000

References

Reference	Source	Link	Tags
supportportal.juniper.net/JSA103146	[email protected]	supportportal.juniper.net	Vendor Advisory
support.juniper.net/support/requesting-support	[email protected]	support.juniper.net	Vendor Advisory
supportportal.juniper.net/s/article/EX-QFX-Procedure-to-format-install-QFX5K-device-usi...	[email protected]	supportportal.juniper.net	Technical Description
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Solutions

CNA: The following software releases have been updated to resolve this specific issue: 21.4R3, 22.2R3-S3, 22.3R1, and all subsequent releases.

Workarounds

CNA: There are no known workarounds for this issue.

Exploits

CNA: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

There are currently no legacy QID mappings associated with this CVE.