CVE Alert: CVE-2025-59964 – Juniper Networks – Junos OS
CVE-2025-59964
A Use of Uninitialized Resource vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX4700 devices allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When forwarding-options sampling is enabled, receipt of any traffic destined to the Routing Engine (RE) by the PFE line card leads to an FPC crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of any traffic leading to the RE by the PFE line card will create a sustained Denial of Service (DoS) condition to the PFE line card. This issue affects Junos OS on SRX4700: * from 24.4 before 24.4R1-S3, 24.4R2 This issue affects IPv4 and IPv6.
AI Summary Analysis
Risk verdict
High risk to availability for affected SRX4700 deployments; network-based DoS without authentication is plausible, and patching should be prioritised in change windows.
Why this matters
The issue can crash the PFE line card when forwarding-options sampling is enabled, forcing an RE restart and prolonged service disruption. In business terms, this risks network uptime, business continuity, and meeting SLAs for critical edge data paths.
Most likely attack path
An unauthenticated, remote attacker can trigger the DoS by sending traffic that the PFE processes to the RE, with no user interaction required. Precondition is that sampling is enabled; exploitation is network-level and does not require credentials, suggesting potential repeatable disruption within reachable network segments.
Who is most exposed
Devices running Junos OS on SRX4700 in data-centre or service-provider edge roles, especially where sampling is configured, are most at risk. Environments still on older 24.4 releases (pre-R1-S3, pre-R2) are the primary concern.
Detection ideas
- FPC crashes and RE restarts logged in system logs
- Sudden traffic loss or intermittent connectivity to services powered by the SRX4700
- Elevated CPU or FPC-specific error messages
- Unauthorised or unexpected RE reachability changes after traffic surges
- Verification of sampling configuration state during baseline checks
Mitigation and prioritisation
- Upgrade to fixed releases: 24.4R1-S3, 24.4R2, 25.2R1 or later
- If cannot patch immediately, temporarily disable forwarding-options sampling
- Restrict traffic from PFE line cards to the RE during remediation
- Validate the fix in a test environment before broad rollout
- Coordinate change windows and monitor post-upgrade stability; treat as priority 1 if KEV/EPSS indicators become available
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below
To keep up to date follow us on the below channels.
