What is the CVSS score of CVE-2025-52983?

CVE-2025-52983 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Junos are affected by CVE-2025-52983?

CVE-2025-52983 is a root authentication bypass in Juniper Junos OS on VM Host Routing Engines where removed SSH public keys remain valid for root access, enabling complete system compromise by…. A patch is available.

How to fix or mitigate CVE-2025-52983?

Within 24 hours: Identify all Juniper Junos OS VM Host Routing Engine deployments and obtain current OS version inventory. Within 7 days: Apply vendor-released patch to all affected systems per Juniper Networks advisory; rotate all root SSH keys system-wide as interim mitigation. Within 30 days: Conduct SSH key audit across all Juniper devices, document key ownership, and implement centralized SSH credential management with automated key rotation.

Junos CVE-2025-52983

EUVD-2025-21147 HIGH

UI Discrepancy for Security Feature (CWE-446)

2025-07-11 sirt@juniper.net

Juniper Authentication Bypass Privilege Escalation Junos

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:27 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.4R2-S3,22.2R3-S7,24.2R1-S2

EUVD ID Assigned

Mar 16, 2026 - 08:18 euvd

EUVD-2025-21147

Analysis Generated

Mar 16, 2026 - 08:18 vuln.today

CVE Published

Jul 11, 2025 - 16:15 nvd

HIGH 7.2

DescriptionCVE.org

A UI Discrepancy for Security Feature

vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device.

On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS:

all versions before 22.2R3-S7,
22.4 versions before 22.4R3-S5,
23.2 versions before 23.2R2-S3,
23.4 versions before 23.4R2-S3,
24.2 versions before 24.2R1-S2, 24.2R2.

AnalysisAI

CVE-2025-52983 is a critical authentication bypass vulnerability in Juniper Networks Junos OS on VM Host Routing Engines where public keys configured for root access are not properly validated, allowing users possessing the corresponding private key to gain unauthorized root-level access even after the public key has been administratively removed from the system. This network-accessible vulnerability affects multiple Junos OS release branches and requires high privileges to configure but enables complete system compromise once exploited. While the CVSS score of 7.2 reflects significant impact, the practical risk depends on KEV designation and active exploitation status.

Technical ContextAI

The vulnerability resides in the SSH authentication implementation of Juniper Networks Junos OS running on VM Host Routing Engines (RE). The root cause stems from CWE-446 (UI Discrepancy for Security Feature), which indicates a mismatch between the security policy as presented in the user interface and the actual security enforcement at the system level. Specifically, when administrators remove a public key for the root user through the management UI, the underlying authentication mechanism fails to properly invalidate or synchronize this change, allowing SSH authentication to succeed with the corresponding private key despite the public key's removal. This affects CPE entries for Juniper Junos OS across multiple version branches: pre-22.2R3-S7, 22.4 before 22.4R3-S5, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S3, and 24.2 before 24.2R1-S2/24.2R2. The vulnerability is specific to VM Host configurations, suggesting it may relate to how key material is managed in virtualized routing engine environments versus physical hardware.

RemediationAI

Upgrade to patched versions: Junos OS 22.2R3-S7 or later for 22.2 branch; 22.4R3-S5 or later for 22.4 branch; 23.2R2-S3 or later for 23.2 branch; 23.4R2-S3 or later for 23.4 branch; 24.2R1-S2, 24.2R2, or later for 24.2 branch. Interim mitigations pending patch deployment: (1) restrict SSH access to root user through firewall rules and management interface ACLs; (2) rotate root private keys and regenerate public keys on affected systems; (3) audit SSH logs for unauthorized root access attempts and successful logins; (4) disable SSH root login if operationally feasible, using alternative authentication mechanisms for privileged access; (5) implement network-level authentication/2FA solutions if available. Consult Juniper Networks security advisory JSA-related documentation for exact patch filenames and deployment procedures. Verify patch applicability to VM Host configurations specifically before applying.