Junos OS CVE-2025-52960

Two concrete conditions must coexist: (1) the SIP Application Layer Gateway (ALG) must be active in the flow/services path on an SRX or MX device, and (2) the device must already be experiencing high memory utilization when the crafted SIP packets arrive. The description explicitly notes this memory state is 'outside the attackers control,' which is the dominant limiting factor - the attacker cannot deterministically trigger the crash and must rely on the device organically being resource-constrained. Exploitation is further limited to availability only (service crash with automatic recovery), and sustained denial requires continuous packet transmission throughout the high-utilization window. Affected: Junos OS before 22.4R3-S7, 23.2 before 23.2R2-S4, 23.4 before 23.4R2-S5, and 24.2 before 24.2R2.

Signals conflict and net out to a moderate, not top-tier, priority. The vendor CVSS 4.0 base of 8.2 is driven almost entirely by a high availability impact (VA:H) under a network, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but it is tempered by AT:P (attack requirements present) - the description makes this explicit: the crash only occurs 'when memory utilization is high,' and that utilization is 'outside the attackers control, so they would not be able to deterministically exploit this.' EPSS agrees with the conservative read: 0.33% probability at the 24th percentile indicates low expected exploitation activity. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. The impact is confined to availability (VC:N/VI:N) with automatic recovery (R:A), meaning no data compromise and only transient outage per event, though sustained flooding during high-memory windows can prolong disruption. Net: a genuine but conditional DoS affecting a widely deployed appliance line - worth patching on a normal cycle rather than an emergency, because the non-attacker-controlled memory precondition and absence of exploitation evidence sharply reduce real-world weaponizability.

An attacker who can reach the SIP ALG on an internet-facing or transit SRX/MX firewall sends a stream of specially crafted SIP packets. If the device happens to be under high memory utilization at that moment, flowd (SRX) or mspmand (MX) crashes, dropping traffic until the daemon restarts; continuously flooding the packets while memory stays high sustains the outage. No public proof-of-concept exists, and success is probabilistic because the attacker cannot control the device's memory state.