Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2025-52989

Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
juniper

Description

An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration. A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration. This issue affects:  Junos OS:  * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S5-EVO,  * 24.2-EVO versions before 24.2R2-S1-EVO * 24.4-EVO versions before 24.4R2-EVO.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Juniper Networks Junos OS

Default version status: unaffected

  • 0 to < 22.2R3-S7affected
  • 22.4 to < 22.4R3-S7affected
  • 23.2 to < 23.2R2-S4affected
  • 23.4 to < 23.4R2-S4affected
  • 24.2 to < 24.2R2-S1affected
  • 24.4 to < 24.4R1-S2, 24.4R2affected

Juniper Networks Junos OS Evolved

Default version status: unaffected

  • 0 to < 22.4R3-S7-EVOaffected
  • 23.2-EVO to < 23.2R2-S4-EVOaffected
  • 23.4-EVO to < 23.4R2-S5-EVOaffected
  • 24.2-EVO to < 24.2R2-S1-EVOaffected
  • 24.4-EVO to < 24.4R2-EVOaffected

References