CVE-2025-52947: junos — Fix

Description

An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platforms allows an attacker to crash the Forwarding Engine Board (FEB) by flapping an interface, leading to a Denial of Service (DoS). On ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096 devices, FEB0 will crash when the primary path port of the L2 circuit IGP (Interior Gateway Protocol) on the local device goes down. This issue is seen only when 'hot-standby' mode is configured for the L2 circuit. This issue affects Junos OS on ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096: * all versions before 21.2R3-S9.

Is your site exposed to CVE-2025-52947?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-755 CWE-755

Affected Products

Vendor	Product	Versions
juniper	junos	< 21.2
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	junos	All
juniper	acx1000	All
juniper	acx1100	All
juniper	acx2000	All
juniper	acx2100	All
juniper	acx2200	All
juniper	acx4000	All
juniper	acx5048	All
juniper	acx5096	All

References

Advisories & Patches

https://supportportal.juniper.net/JSA100051

Frequently Asked Questions

What is CVE-2025-52947? +

An Improper Handling of Exceptional Conditions vulnerability in route processing of Juniper Networks Junos OS on specific end-of-life (EOL) ACX Series platforms allows an attacker to crash the Forwarding Engine Board (FEB) by flapping an interface, leading to a Denial of Service (DoS). On ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096 devices, FEB0 will crash when the primary path port of the L2 circuit IGP (Interior Gateway Protocol) on the local device goes down. This issue is seen only when 'hot-standby' mode is configured for the L2 circuit. This issue affects Junos OS on ACX1000, ACX1100, ACX2000, ACX2100, ACX2200, ACX4000, ACX5048, and ACX5096: * all versions before 21.2R3-S9. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-52947? +

CVE-2025-52947 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-52947? +

CVE-2025-52947 affects products from juniper, specifically: acx1000, acx1100, acx2000, acx2100, acx2200, acx4000, acx5048, acx5096, junos. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-52947? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when …

CVE-2025-9437

A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distributed motor controller, …

CVE-2024-51502

loona is an experimental, HTTP/1.1 and HTTP/2 implementation in Rust on top of io-uring. `loona-hpack` suffers from the same vulnerability …

CVE-2024-41886

Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. …

CVE-2026-48036

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers …

CVE-2026-42792

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the …

CVE-2025-52947