Junos OS and Junos OS Evolved: Device allows login for user with expired password
Summary
| CVE | CVE-2025-60010 |
|---|---|
| State | PUBLISHED |
| Assigner | juniper |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-09 17:16:04 UTC |
| Updated | 2026-06-17 09:49:12 UTC |
| Description | A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. Affected devices allow logins by users for whom the RADIUS server has responded with a reject and required the user to change the password as their password was expired. Therefore the policy mandating the password change is not enforced. This does not allow users to login with a wrong password, but only with the correct but expired one. This issue affects: Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S5, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S3, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * 23.2 versions before 23.2R2-S4-EVO, * 23.4 versions before 23.4R2-S5-EVO, * 24.2 versions before 24.2R2-S1-EVO, * 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO. |
Risk And Classification
Primary CVSS: v4.0 5.3 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
EPSS: 0.001760000 probability, percentile 0.066110000 (date 2026-10-18)
Problem Types: CWE-262 | CWE-262 CWE-262 Not Using Password Aging
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 5.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/RE:M |
| 3.1 | [email protected] | Secondary | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 5.4 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
LowUser Interaction
NoneConfidentiality
LowIntegrity
LowAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Juniper | Junos | All | All | All | All |
| Operating System | Juniper | Junos | 22.4 | - | All | All |
| Operating System | Juniper | Junos | 22.4 | r1 | All | All |
| Operating System | Juniper | Junos | 22.4 | r1-s1 | All | All |
| Operating System | Juniper | Junos | 22.4 | r1-s2 | All | All |
| Operating System | Juniper | Junos | 22.4 | r2 | All | All |
| Operating System | Juniper | Junos | 22.4 | r2-s1 | All | All |
| Operating System | Juniper | Junos | 22.4 | r2-s2 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s1 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s2 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s3 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s4 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s5 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s6 | All | All |
| Operating System | Juniper | Junos | 22.4 | r3-s7 | All | All |
| Operating System | Juniper | Junos | 23.2 | - | All | All |
| Operating System | Juniper | Junos | 23.2 | r1 | All | All |
| Operating System | Juniper | Junos | 23.2 | r1-s1 | All | All |
| Operating System | Juniper | Junos | 23.2 | r1-s2 | All | All |
| Operating System | Juniper | Junos | 23.2 | r2 | All | All |
| Operating System | Juniper | Junos | 23.2 | r2-s1 | All | All |
| Operating System | Juniper | Junos | 23.2 | r2-s2 | All | All |
| Operating System | Juniper | Junos | 23.2 | r2-s3 | All | All |
| Operating System | Juniper | Junos | 23.4 | - | All | All |
| Operating System | Juniper | Junos | 23.4 | r1 | All | All |
| Operating System | Juniper | Junos | 23.4 | r1-s1 | All | All |
| Operating System | Juniper | Junos | 23.4 | r1-s2 | All | All |
| Operating System | Juniper | Junos | 23.4 | r2 | All | All |
| Operating System | Juniper | Junos | 23.4 | r2-s1 | All | All |
| Operating System | Juniper | Junos | 23.4 | r2-s2 | All | All |
| Operating System | Juniper | Junos | 23.4 | r2-s3 | All | All |
| Operating System | Juniper | Junos | 23.4 | r2-s4 | All | All |
| Operating System | Juniper | Junos | 24.2 | - | All | All |
| Operating System | Juniper | Junos | 24.2 | r1 | All | All |
| Operating System | Juniper | Junos | 24.2 | r1-s1 | All | All |
| Operating System | Juniper | Junos | 24.2 | r1-s2 | All | All |
| Operating System | Juniper | Junos | 24.2 | r2 | All | All |
| Operating System | Juniper | Junos | 24.4 | - | All | All |
| Operating System | Juniper | Junos | 24.4 | r1 | All | All |
| Operating System | Juniper | Junos | 24.4 | r1-s2 | All | All |
| Operating System | Juniper | Junos | 24.4 | r2 | All | All |
| Operating System | Juniper | Junos Os Evolved | All | All | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | - | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r1-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r1-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r2-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r2-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s3 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s4 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s5 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s6 | All | All |
| Operating System | Juniper | Junos Os Evolved | 22.4 | r3-s7 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | - | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r1-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r1-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.2 | r2-s3 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | - | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r1-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r1-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r2-s1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r2-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r2-s3 | All | All |
| Operating System | Juniper | Junos Os Evolved | 23.4 | r2-s4 | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.2 | - | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.2 | r1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.2 | r1-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.2 | r2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.4 | - | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.4 | r1 | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.4 | r1-s2 | All | All |
| Operating System | Juniper | Junos Os Evolved | 24.4 | r2 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Juniper Networks | Junos OS | affected 22.4R3-S8 semver | Not specified |
| CNA | Juniper Networks | Junos OS | affected 23.2 23.2R2-S4 semver | Not specified |
| CNA | Juniper Networks | Junos OS | affected 23.4 23.4R2-S5 semver | Not specified |
| CNA | Juniper Networks | Junos OS | affected 24.2 24.2R2-S1 semver | Not specified |
| CNA | Juniper Networks | Junos OS | affected 24.4 24.4R1-S3, 24.4R2 semver | Not specified |
| CNA | Juniper Networks | Junos OS Evolved | affected 22.4R3-S8-EVO semver | Not specified |
| CNA | Juniper Networks | Junos OS Evolved | affected 23.2 23.2R2-S4-EVO semver | Not specified |
| CNA | Juniper Networks | Junos OS Evolved | affected 23.4 23.4R2-S5-EVO semver | Not specified |
| CNA | Juniper Networks | Junos OS Evolved | affected 24.2 24.2R2-S1-EVO semver | Not specified |
| CNA | Juniper Networks | Junos OS Evolved | affected 24.4 24.4R1-S3-EVO, 24.4R2-EVO semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| supportportal.juniper.net/JSA103168 | [email protected] | supportportal.juniper.net | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 22.4R3-S8-EVO, 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S3-EVO, 24.4R2-EVO, 25.2R1-EVO, and all subsequent releases; Junos OS: 22.4R3-S8, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, 24.4R2, 25.2R1, and all subsequent releases.
Workarounds
CNA: There are no known workarounds for this issue.
Exploits
CNA: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
There are currently no legacy QID mappings associated with this CVE.