Juniper Junos OS CVE-2025-59980

Exploitation requires two specific, non-default conditions that must BOTH hold: the Junos FTP server must be explicitly enabled, and a local user account named exactly 'ftp' or 'anonymous' must be configured. When those exist, that account can log in without presenting the configured password (the authentication bypass) and obtains read-write access limited to its own home directory. Limiting factors: FTP is not enabled by default and these specially-named accounts are uncommon, so default or hardened configurations are not affected; access is confined to the home directory with no code execution or privilege escalation; and affected versions are bounded (all before 22.4R3-S8, 23.2 before 23.2R2-S3, 23.4 before 23.4R2). No user interaction is required once the vulnerable configuration is present.

This is a medium-severity authentication bypass (vendor CVSS 4.0 base 6.9) whose real-world risk is tightly bounded by non-default preconditions rather than by the raw score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly indicates a network-based, unauthenticated attack with low complexity, but impact is deliberately scoped low (VC:L/VI:L/VA:N) - only limited read-write access to the 'ftp'/'anonymous' user's home directory, not full device compromise or code execution. The signals are internally consistent and point to a low-to-moderate priority: EPSS is 0.29% (20th percentile), indicating low predicted exploitation probability; there is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The most important caveat is that the CVSS PR:N/AV:N framing understates the real barrier - exploitation requires the operator to have (a) explicitly enabled the FTP server and (b) configured a user literally named 'ftp' or 'anonymous'. Both are atypical on hardened Junos deployments, so this behaves more like a targeted misconfiguration-dependent issue than a broadly exploitable remote flaw. Treat as a configuration-hygiene and patch item, not an emergency; prioritize checking whether FTP and those accounts are present before escalating.

An attacker with network reachability to a Junos device that has the FTP server enabled and an account named 'ftp' or 'anonymous' configured connects to the FTP service and authenticates as that user without supplying the configured password. With that foothold they read and write files within the account's home directory, potentially staging or tampering with files. No public exploit code has been identified, and exploitation is impossible unless the specific FTP-enabled, named-account configuration is present.