Junos OS (SRX firewalls)
CVE-2025-59959: Executing a specific show command leads to an rpd crash
An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS).
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS 0 | 22.4R3-S8 or later |
| Junos OS 23.2 | 23.2R2-S5 or later |
| Junos OS 23.4 | 23.4R2-S5 or later |
| Junos OS 24.2 | 24.2R2-S2 or later |
| Junos OS 24.4 | 24.4R2 or later |
| Junos OS Evolved 0 | 22.4R3-S8-EVO or later |
| Junos OS Evolved 23.2 | 23.2R2-S5-EVO or later |
| Junos OS Evolved 23.4 | 23.4R2-S6-EVO or later |
| Junos OS Evolved 24.2 | 24.2R2-S2-EVO or later |
| Junos OS Evolved 24.4 | 24.4R2-EVO or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS).
When the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart. 'show route ... extensive' is not affected.
This issue affects:
Junos OS:
- all versions before 22.4R3-S8,
- 23.2 versions before 23.2R2-S5,
- 23.4 versions before 23.4R2-S5,
- 24.2 versions before 24.2R2-S2,
- 24.4 versions before 24.4R2;
Junos OS Evolved:
- all versions before 22.4R3-S8-EVO,
- 23.2 versions before 23.2R2-S5-EVO,
- 23.4 versions before 23.4R2-S6-EVO,
- 24.2 versions before 24.2R2-S2-EVO,
- 24.4 versions before 24.4R2-EVO.
Am I affected?
To be exposed to this issue a BGP peering needs to be configured via:
[ protocols bgp ... neighbor ... ]
Workarounds
Use access lists or firewall filters to limit access to the CLI only from trusted hosts and administrators.
Utilize CLI authorization to disallow execution of the 'show route' command with the 'detail' option.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.