Junos OS Evolved CVE-2025-52961

Exploitation requires that Connectivity Fault Management (CFM / 802.1ag) be configured and active on the device, and that the attacker occupy an adjacent position on a directly connected L2 segment (AV:A) from which the specific valid CFM packets can reach cfmd. Limiting factors: only Junos OS Evolved on PTX10001-36MR, PTX10002-36QDD, PTX10004, PTX10008, and PTX10016 running affected trains (from 23.2R1-EVO through the listed fixed versions) is vulnerable; releases before 23.2R1-EVO are not affected; no authentication or user interaction is needed (PR:N/UI:N), but the adjacency requirement means purely remote internet-based exploitation is not possible.

This is a genuine but moderate-priority operational availability issue rather than a critical emergency. The CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N) confirms an adjacent, unauthenticated, low-complexity attack, but the impact is availability-only (VC:N/VI:N/VA:H, SA:L) - there is no confidentiality or integrity exposure. Signals are largely consistent: the adjacency requirement (AV:A) means an attacker must already be on a directly connected L2 segment, which meaningfully narrows the threat to a position inside the network rather than the open internet. EPSS is low at 0.48% (40th percentile), which aligns with the adjacency constraint and the narrow affected-device scope and argues against mass, opportunistic exploitation. A public exploit is reported to exist (POC=YES) but there is no CISA KEV listing, so there is no evidence of active exploitation - POC availability and active exploitation are distinct and should not be conflated. The one point worth verifying is the AU:Y (automatable) and V:C (concentrated value) supplemental metrics combined with a public POC: an on-path attacker could sustain the DoS cheaply, so for operators of the specific affected PTX10000-series routers this warrants prompt patching despite the modest 7.1 score. Net: real but position-gated availability risk, not a high-CVSS-but-illusory issue.

An attacker who has gained a foothold on a device directly adjacent to an affected PTX10000-series router (e.g., a compromised neighbor on the same L2 link where CFM is active) sends a stream of specific but otherwise valid CFM packets. This drives the cfmd process to 100% CPU and leaks cfmman memory until the FPC (line card) crashes and restarts; continued packet delivery sustains the outage. A public exploit is reported to exist, and the low attack complexity (AC:L) means no special timing or race is required.