Junos OS Evolved: ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: When specific valid multicast traffic is received on the L3 interface on a vulnerable device evo-pfemand crashes and restarts
Summary
| CVE | CVE-2025-59967 |
|---|---|
| State | PUBLISHED |
| Assigner | juniper |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-09 16:15:46 UTC |
| Updated | 2026-10-08 13:10:00 UTC |
| Description | A NULL Pointer Dereference vulnerability in the PFE management daemon (evo-pfemand) of Juniper Networks Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 devices allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Whenever specific valid multicast traffic is received on any layer 3 interface the evo-pfemand process crashes and restarts. Continued receipt of specific valid multicast traffic results in a sustained Denial of Service (DoS) attack. This issue affects Junos OS Evolved on ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: * from 23.2R2-EVO before 23.2R2-S4-EVO, * from 23.4R1-EVO before 23.4R2-EVO. This issue affects IPv4 and IPv6. This issue does not affect Junos OS Evolved ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509 versions before 23.2R2-EVO. |
Risk And Classification
Primary CVSS: v4.0 7.1 HIGH from [email protected]
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green
EPSS: 0.002010000 probability, percentile 0.090870000 (date 2026-10-08)
Problem Types: CWE-476 | CWE-476 CWE-476: NULL Pointer Dereference
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.1 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/C... |
| 4.0 | CNA | CVSS | 7.1 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/... |
| 3.1 | [email protected] | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green
CVSS v3.1 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Juniper | Acx7024 | - | All | All | All |
| Hardware | Juniper | Acx7024x | - | All | All | All |
| Hardware | Juniper | Acx7100-32c | - | All | All | All |
| Hardware | Juniper | Acx7100-48l | - | All | All | All |
| Hardware | Juniper | Acx7348 | - | All | All | All |
| Hardware | Juniper | Acx7509 | - | All | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2-s3 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r1-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r1-s2 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Juniper Networks | Junos OS Evolved | affected 23.2R2-EVO 23.2R2-S4-EVO semver | ACX7348, ACX7024, ACX7509, ACX7024X, ACX7100-32C, ACX7100-48L |
| CNA | Juniper Networks | Junos OS Evolved | affected 23.4R1-EVO 23.4R2-EVO semver | ACX7348, ACX7024, ACX7509, ACX7024X, ACX7100-32C, ACX7100-48L |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| supportportal.juniper.net/JSA103156 | [email protected] | supportportal.juniper.net | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 23.2R2-S4-EVO, 23.4R2-EVO, 24.2R1-EVO, and all subsequent releases.
Workarounds
CNA: There are no known workarounds for this issue. To reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted hosts.
Exploits
CNA: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.