CVE-2025-52983
Last modified
CVE-2025-52983 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2.. EPSS estimates a 0.60% chance of exploitation in the next 30 days.
Description
A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Juniper | Junos | < 22.2 |
| Juniper | Junos | 22.2 |
| Juniper | Junos | 22.4 |
| Juniper | Junos | 23.2 |
| Juniper | Junos | 23.4 |
| Juniper | Junos | 24.2 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-52983?
How severe is CVE-2025-52983?
How do I fix CVE-2025-52983?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-52978Rejected reason: Not used
- CVE-2025-52979Rejected reason: Not used
- CVE-2025-5298A vulnerability, which was classified as critical, was found…9.8
- CVE-2025-52980A Use of Incorrect Byte Ordering vulnerability in the Ro…8.7
- CVE-2025-52981An Improper Check for Unusual or Exceptional Conditions vuln…8.7
- CVE-2025-52982An Improper Resource Shutdown or Release vulnerability in th…8.2
- CVE-2025-52984A NULL Pointer Dereference vulnerability in the routing prot…8.2
- CVE-2025-52985A Use of Incorrect Operator vulnerability in the Routing En…6.9
- CVE-2025-52986A Missing Release of Memory after Effective Lifetime vulnera…6.8
- CVE-2025-52987A clickjacking vulnerability exists in the web portal of Jun…6.1
- CVE-2025-52988An Improper Neutralization of Special Elements used in an OS…8.4
- CVE-2025-52989An Improper Neutralization of Delimiters vulnerability in th…6.8
Are you affected by CVE-2025-52983?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST