Junos OS
CVE-2025-60010
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHold valid but expired RADIUS credentials
-
ExploitInitiate login to Junos RADIUS client
-
ExecutionServer reject with change-required is ignored
-
ImpactGain device access bypassing password-change policy
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Requires the device to use RADIUS authentication (the Junos RADIUS client) AND an affected account whose RADIUS password has expired such that the RADIUS server returns a reject mandating a password change. The actor must supply the user's correct current (expired) password - wrong passwords are still rejected - so valid credentials are a hard prerequisite (PR:L). Exploitation is further limited to the listed vulnerable version trains (Junos OS / Junos OS Evolved before 22.4R3-S8, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3/24.4R2 and their -EVO equivalents); no user interaction is required. |
| Impact | This is a genuine but modest-severity access-control weakness, not a high-urgency priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 (Medium): network-reachable and low-complexity, but PR:L means the attacker must already hold valid credentials - specifically the user's own correct (if expired) password - which sharply limits who can abuse it. The impact is limited (VC:L/VI:L, no availability impact), consistent with CWE-262 (improper enforcement of password aging) rather than a full authentication bypass. Corroborating low-risk signals: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit was identified. All signals align - low exploitation probability, no active exploitation, credentialed-only access - so this does not contradict its medium CVSS. One caveat: the 'VC:L/VI:L' confidentiality/integrity impact is best understood as the account retaining access it should have lost, not as data exfiltration; the input 'Information Disclosure' tag mischaracterizes this as a disclosure issue when it is an access-control/policy-enforcement flaw. |
| Exploit ScenarioDerived | A user whose RADIUS password has expired - and for whom the RADIUS server returns a reject demanding a password change - enters their correct current (expired) password to log into a Junos device. Instead of being forced through the mandatory password-change workflow, they are granted normal access, retaining a login that policy intended to revoke until the password was reset. No public exploit code is required or known; abuse only needs the legitimate-but-expired credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Junos OS and Junos OS Evolved can accept logins from users whose RADIUS password has expired, bypassing the RADIUS server's requirement that the password be changed. An authenticated, network-based attacker who already possesses a user's correct but expired RADIUS password can obtain access without completing the mandated password change, affecting confidentiality and integrity at a low level. No public exploit was identified at time of analysis, and EPSS is low at 0.18% (7th percentile).
RemediationAI
Vendor-released patched versions are Junos OS 22.4R3-S8, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S3, or 24.4R2; and Junos OS Evolved 22.4R3-S8-EVO, 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R1-S3-EVO, or 24.4R2-EVO. See the Juniper advisory at https://supportportal.juniper.net/JSA103168. No vendor workaround is identified in the provided data; until patching, restrict management access to trusted networks with firewall filters or ACLs, which reduces exposure but does not correct the password-aging bypass, and where strict expiration enforcement is mandatory, temporarily avoid RADIUS authentication for affected accounts or use local authentication with compensating controls, noting that both disrupt centralized authentication and require operational handling.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in the Junos RADIUS client used for centralized authentication. When a RADIUS server rejects an authentication attempt because the user's password is expired and mandates a password change, affected Junos OS and Junos OS Evolved releases permit the login instead of denying normal access and forcing the password-change flow. This is classified as CWE-262 (Not Using Password Aging) and is an access-control and policy-enforcement weakness rather than a credential-guessing flaw: a wrong password is still rejected, and exploitation requires the correct expired password plus a RADIUS-authenticated deployment. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, reflecting low confidentiality and integrity impact with no availability impact.
Know when Junos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/RE:M
Network-reachable RADIUS login (AV:N/AC:L) but the attacker must possess the user's own valid-though-expired credentials, so PR:L; impact is limited retained access, hence C:L/I:L/A:N.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
DescriptionCVE.org
A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change.
Affected devices allow logins by users for whom the RADIUS server has responded with a reject and required the user to change the password as their password was expired. Therefore the policy mandating the password change is not enforced. This does not allow users to login with a wrong password, but only with the correct but expired one.
This issue affects:
Junos OS:
- all versions before 22.4R3-S8,
- 23.2 versions before 23.2R2-S4,
- 23.4 versions before 23.4R2-S5,
- 24.2 versions before 24.2R2-S1,
- 24.4 versions before 24.4R1-S3, 24.4R2;
Junos OS Evolved:
- all versions before 22.4R3-S8-EVO,
- 23.2 versions before 23.2R2-S4-EVO,
- 23.4 versions before 23.4R2-S5-EVO,
- 24.2 versions before 24.2R2-S1-EVO,
- 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fe
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (
A security vulnerability in An Improper (CVSS 6.7) that allows a local attacker with high privileges. Risk factors: acti
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series all
jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3,
Juniper Junos 11.4 before R11, 12.1 before R9, 12.1X44 before D30, 12.1X45 before D20, 12.1X46 before D15, 12.1X47 befor
NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby al
NFX Series devices using Juniper Networks Junos OS are susceptible to a local code execution vulnerability thereby allow
Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffe
An Out-of-Bounds Write vulnerability in the H.323 ALG of Juniper Networks Junos OS allows an unauthenticated, network-ba
On QFX10000 Series devices using Juniper Networks Junos OS when configured as transit IP/MPLS penultimate hop popping (P
A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an
GitHub PoC
Exploit-DB