Junos OS CVE-2025-59964

Exploitation requires that 'forwarding-options sampling' be configured/enabled on an affected SRX4700 device - this is the exact non-default feature that must be active; without it the issue is not triggered. The device must run Junos OS 24.4 before 24.4R1-S3 or 24.4R2, and the flaw is specific to the SRX4700 hardware model (not SRX family generally). Once those conditions hold, no authentication, user interaction, or special positioning is needed: any IPv4 or IPv6 traffic destined to the Routing Engine, processed by the PFE line card, triggers the FPC crash. Limiting factors that reduce real-world exposure: the sampling configuration requirement, the single affected platform, and the narrow vulnerable version range.

This is a genuine availability-focused priority for the specific population that runs it, but narrower than the 8.7 CVSS 4.0 score suggests in isolation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, unauthenticated, low-complexity trigger with no user interaction - attractive on paper - and impact is purely availability (VA:H plus a subsequent-system SA:L reflecting the FPC/line-card crash), with no confidentiality or integrity loss. However, the EPSS score is low at 0.36% (27th percentile), there is no CISA KEV listing, and no public exploit code was provided, so the signals converge on 'no public exploit identified at time of analysis' rather than active or imminent mass exploitation. The most important moderating factor is that exploitation is gated on a non-default prerequisite - forwarding-options sampling must be enabled on an SRX4700 - and the affected scope is a single, recently introduced high-end hardware model on a narrow Junos version band (24.4 before 24.4R1-S3/24.4R2). Reported by Juniper's own SIRT, this is a vendor-confirmed DoS rather than a code-execution flaw. Net: patch promptly where sampling is enabled on SRX4700, but this is not a 'drop everything' internet-wide crisis; it is a targeted, config-dependent availability bug.

On an SRX4700 running an affected Junos 24.4 build with forwarding-options sampling enabled, a remote unauthenticated attacker simply sends any IPv4 or IPv6 traffic destined to the Routing Engine; the PFE line card mishandles it due to use of an uninitialized resource, crashing and restarting the FPC. By continuously sending such traffic the attacker holds the line card in a restart loop, producing a sustained denial of service. No public exploit code is identified at time of analysis, but the trigger is trivial - ordinary RE-bound traffic.