What is the CVSS score of CVE-2025-52985?

CVE-2025-52985 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-52985?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Junos Os Evolved CVE-2025-52985

Q: Which versions of Junos Os Evolved are affected by CVE-2025-52985?

CVE-2025-52985 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

EUVD-2025-21145 MEDIUM

Use of Incorrect Operator (CWE-480)

2025-07-11 sirt@juniper.net

Authentication Bypass Juniper Junos Os Evolved

5.3

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-480 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Use of incorrect operator
Impact	CVSS 5.3. EPSS 0.0%. No patch confirmed.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in the affected application to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

CVE-2025-52985 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 08:18 CVSS 5.3

A Use of Incorrect Operator vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions. When a

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

Junos OS Evolved 23.4R2-S3-EVO <23.4R2-S5-EVO

Junos OS Evolved 24.4-EVO <24.4R1-S3-EVO, 24.4R2-EVO

Junos OS Evolved 24.2R2-EVO <24.2R2-S1-EVO

Junos OS Evolved 23.2R2-S3-EVO <23.2R2-S4-EVO

Affected Packages

euvd junos_os_evolved fix: 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO

euvd junos_os_evolved_24_4_evo_24_4r1_s3_evo no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type not specified by vendor.

Know when Junos Os Evolved gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

23.4R2-S5-EVO,24.4R1-S3-EVO,24.2R2-S1-EVO

CVE Published

Jul 11, 2025 - 16:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A Use of Incorrect Operator

vulnerability in the Routing Engine firewall of Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to bypass security restrictions.

When a firewall filter which is applied to the lo0 or re:mgmt interface references a prefix list with 'from prefix-list', and that prefix list contains more than 10 entries, the prefix list doesn't match and packets destined to or from the local device are not filtered.

This issue affects firewall filters applied to the re:mgmt interfaces as input and output, but only affects firewall filters applied to the lo0 interface as output. This issue is applicable to IPv4 and IPv6 as a prefix list can contain IPv4 and IPv6 prefixes. This issue affects Junos OS Evolved:

23.2R2-S3-EVO versions before 23.2R2-S4-EVO,
23.4R2-S3-EVO versions before 23.4R2-S5-EVO,
24.2R2-EVO versions before 24.2R2-S1-EVO,
24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO.

This issue doesn't affect Junos OS Evolved versions before 23.2R1-EVO.

Executive ViewAI

Why It Matters

CVE-2025-52985 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score

0.0%

Top 96% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Junos Os Evolved

View all

CVE-2026-33788 HIGH This Week POC

8.5 Apr 09

Local privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with lo

CVE-2021-31353 HIGH This Week POC

7.5 Oct 19

An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an

CVE-2025-52961 HIGH This Week POC

7.1 Oct 09

An unauthenticated attacker on an adjacent Layer 2 segment can sustain a denial-of-service condition against Juniper Jun

CVE-2024-39553 MEDIUM This Month POC

6.9 Jul 11

An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allow

CVE-2026-101967 CRITICAL Act Now

9.3 Oct 14

Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon

CVE-2021-0211 CRITICAL Act Now

10.0 Jan 15

An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protoc

CVE-2026-102031 CRITICAL Act Now

9.3 Oct 14

Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitr

CVE-2022-22215 MEDIUM This Month POC

5.5 Jul 20

A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module

CVE-2026-101978 HIGH This Week

8.7 Oct 14

Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evo

CVE-2026-102059 HIGH This Week

8.7 Oct 14

OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u

CVE-2026-102175 CRITICAL Act Now

9.3 Oct 14

Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow

CVE-2026-101986 CRITICAL Act Now

9.3 Oct 14

Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro

Same weakness CWE-480 – Use of Incorrect Operator

View all

CVE-2022-1947 MEDIUM POC

6.5

CVE-2026-15043 CRITICAL

9.8

CVE-2026-43114 CRITICAL

9.4

CVE-2026-48497 HIGH

7.5

CVE-2026-4748 HIGH

7.5

CVE-2026-79643 HIGH

7.3

CVE-2026-44722 MEDIUM

6.2

CVE-2026-83525 LOW

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-52985 ADVISORY https://supportportal.juniper.net/JSA100091

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back