Juniper Junos OS CVE-2025-59957

Requires two concrete conditions: (1) PHYSICAL access to the EX4600 Series or QFX5000 Series device, and (2) the device must NOT have a root password configured - this unprotected state is what allows the attacker to modify /etc/config/<platform>-defaults[-flex].conf so its contents are silently appended to the Junos configuration. Limiting factors that reduce realistic risk: exploitation is impossible remotely or over the network, requires hands-on device access, and is neutralized by simply setting a root password; it does not require user interaction or prior authentication once physical access is obtained. The compromise is persistent across reboots and zeroization, so only reinstallation from physical media restores a trusted state.

This is a high-severity but operationally narrow issue. The CVSS 4.0 vector (AV:P) confirms exploitation requires PHYSICAL access to the EX4600/QFX5000 device, which is the single most significant risk-limiting factor and is the primary reason the base score is 7.0 rather than critical despite VC:H/VI:H/VA:H (full confidentiality, integrity, and availability compromise). EPSS strongly corroborates the low real-world urgency: 0.18% probability at the 7th percentile, consistent with a physical-access vulnerability that cannot be exploited remotely or at scale. The vulnerability is NOT in CISA KEV and no public exploit code was provided in the input, so there is no evidence of active exploitation - no public exploit identified at time of analysis. The signals are therefore internally consistent rather than conflicting: high technical impact but low exploitation probability due to the physical-access barrier. The genuinely alarming dimensions are impact-related, not likelihood-related: the injected backdoor is invisible to the operator and PERSISTS across reboots AND zeroization, meaning standard factory-reset remediation does not clean it (reinstall from physical media is required). One nuance to verify: the input CVSS marks PR:N (no privileges), yet exploitation depends on the device having no root password configured - this is a deployment-state precondition rather than a privilege, so PR:N is defensible but defenders should treat 'no root password set' as the true gating condition. Net: a real priority only for organizations where physical access to these switches is plausible (shared racks, remote/edge sites, supply-chain/pre-staging, insider risk); for physically controlled data centers it is low practical risk.

An attacker with brief physical access to an EX4600 or QFX5000 switch that has no root password configured modifies the /etc/config/<platform>-defaults[-flex].conf file, injecting configuration (e.g. a hidden user account or management IP) that Junos silently merges into the running configuration without displaying it to the operator. Because low attack complexity (AC:L) and no authentication are involved once physical access is obtained, the attacker gains a stealthy, persistent backdoor that survives reboots and even zeroization. No public exploit code was identified in the provided data.