Junos OS (SRX firewalls)
CVE-2025-21601: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device
An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series) 0 | 21.4R3-S9 or later |
| Junos OS (SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series) 22.2 | 22.2R3-S5 or later |
| Junos OS (SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series) 22.4 | 22.4R3-S4 or later |
| Junos OS (SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series) 23.2 | 23.2R2-S3 or later |
| Junos OS (SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series) 23.4 | 23.4R2-S3 or later |
| Junos OS (SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series) 24.2 | 24.2R1-S1, 24.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive.
Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition.
This issue affects Junos OS:
- All versions before 21.4R3-S9,
- from 22.2 before 22.2R3-S5,
- from 22.4 before 22.4R3-S4,
- from 23.2 before 23.2R2-S3,
- from 23.4 before 23.4R2-S3,
- from 24.2 before 24.2R1-S1, 24.2R2.
An indicator of compromise is to review the CPU % of the httpd process in the CLI: e.g. show system processes extensive | match httpd PID nobody 52 0 20M 191M select 2 0:01 80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator
Am I affected?
The following minimal configuration is necessary:
[ system services web-management ]
Workarounds
There are no known workarounds for this issue.
To reduce the risk of exploitation use authentication when using web management services.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.