EUVD-2025-209396
GHSA-qr7g-rj69-5948
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | DoS vulnerability affecting PTX and QFX5000 series routers via unauthenticated adjacent multicast packets. CVSS 7.1 reflects high availability impact. Adjacent-only attack vector and lack of KEV/public POC limit immediate threat scope, but sustained packet transmission causes persistent device restarts. Affects multiple OS versions with significant remediation coverage required across fleet deployments. |
| Exploit ScenarioDerived | Attacker on adjacent network segment crafts malformed multicast packets triggering buffer overflow in evo-aftmand/evo-pfemand. Continuous packet transmission maintains DoS condition, forcing repeated line card or device restarts. No public exploit identified at time of analysis; unauthenticated attack requires only network adjacency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Unauthenticated buffer overflow in Juniper Networks Junos OS Evolved advanced forwarding toolkit (evo-aftmand/evo-pfemand) permits adjacent attackers to crash PTX Series and QFX5000 Series devices via crafted multicast packets. Exploitation triggers line card or device restart, sustaining denial of service under continuous attack. Affects multiple Junos OS Evolved release branches before patched versions. No public exploit identified at time of analysis. Attack requires adjacent network access but no authentication, making exploitation feasible in shared network segments.
RemediationAI
Vendor-released patches: upgrade PTX Series to 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-EVO, 24.2R2-EVO, or 24.4R2-EVO depending on deployment branch. Upgrade QFX5000 Series to 22.2R3-S7-EVO, 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S3-EVO, or 24.4R2-EVO. QFX5000 versions before 21.2R2-S1-EVO, 21.2R3-EVO, 21.3R2-EVO, 21.4R1-EVO, and 22.1R1-EVO confirmed unaffected. As workaround prior to patching, implement strict adjacent network access controls and multicast traffic filtering to limit attacker exposure. Complete remediation guidance and affected version matrices available in vendor security advisory: https://kb.juniper.net/JSA103159
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classic buffer overflow (CWE-120) in forwarding plane management daemons processes oversized multicast packets without bounds checking. Affects advanced forwarding toolkit components responsible for packet processing on PTX/QFX5000 hardware. CVSS 4.0 vector confirms unauthenticated adjacent vector (AV:A/PR:N) with high availability impact (VA:H) and subsequent system impact (SA:L).
Know when Junos Os Evolved gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/V:C/RE:M/U:Amber
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the advanced forwarding toolkit (evo-aftmand/evo-pfemand) of Juniper Networks Junos OS Evolved on PTX Series or QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).An attacker sending crafted multicast packets will cause line cards running evo-aftmand/evo-pfemand to crash and restart or non-line card devices to crash and restart. Continued receipt and processing of these packets will sustain the Denial of Service (DoS) condition.
This issue affects Junos OS Evolved PTX Series:
- All versions before 22.4R3-S8-EVO,
- from 23.2 before 23.2R2-S5-EVO,
- from 23.4 before 23.4R2-EVO,
- from 24.2 before 24.2R2-EVO,
- from 24.4 before 24.4R2-EVO.
This issue affects Junos OS Evolved on QFX5000 Series:
- 22.2-EVO version before 22.2R3-S7-EVO,
- 22.4-EVO version before 22.4R3-S7-EVO,
- 23.2-EVO versions before 23.2R2-S4-EVO,
- 23.4-EVO versions before 23.4R2-S5-EVO,
- 24.2-EVO versions before 24.2R2-S1-EVO,
- 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO.
This issue does not affect Junos OS Evolved on QFX5000 Series versions before: 21.2R2-S1-EVO, 21.2R3-EVO, 21.3R2-EVO, 21.4R1-EVO, and 22.1R1-EVO.
Executive ViewAI
CVE-2025-59969 is a high-severity buffer overflow in Juniper Junos OS Evolved that allows unauthenticated attackers on adjacent networks to crash PTX and QFX5000 series devices through malicious multicast packets, causing repeated service disruptions. Organizations operating these devices in shared or hostile network environments face immediate availability risk, with sustained attacks capable of maintaining outages without requiring valid credentials.
Apply vendor patch. Interim mitigations if patching is delayed: (1) implement strict multicast packet filtering and rate-limiting at network ingress points to block suspicious adjacent-network traffic; (2) isolate affected PTX/QFX5000 devices from untrusted network segments where feasible; (3) enable device restart monitoring and automated alerting to detect denial of service patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Junos Os Evolved
View allLocal privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with lo
An Improper Handling of Exceptional Conditions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an
An unauthenticated attacker on an adjacent Layer 2 segment can sustain a denial-of-service condition against Juniper Jun
An Exposure of Resource to Wrong Sphere vulnerability in the sampling service of Juniper Networks Junos OS Evolved allow
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon
An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing Protoc
Authenticated, low-privileged TACACS+ users on Juniper Networks Junos OS Evolved can escalate to root and execute arbitr
A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evo
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Exploit-DB