CVE-2025-21590

Juniper Junos OS contains an improper isolation or compartmentalization flaw (CWE-653) in the kernel that allows a local attacker with high privileges to inject arbitrary code and compromise the integrity of the device. The issue cannot be triggered from the Junos CLI, so exploitation requires shell access, such as via a compromised or rogue high-privileged account or as part of a chained attack. Code running in the kernel gives the attacker deep control of the device, enabling persistent tampering such as backdoors or rootkits. All Junos OS releases before the listed fix versions across the 21.2 through 24.2 branches are affected, covering Juniper's routing, switching, and security product lines. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-13, confirming exploitation in the wild, amid headlines reporting China-linked APT UNC3886 breaching Juniper routers with custom backdoors and rootkits.

What to do: Upgrade affected systems to 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 23.4R2-S4, or 24.2R1-S2/24.2R2 per branch; releases older than 21.2 have no listed fix and require migration to a supported fixed release. Restrict shell/root access to trusted administrators and, given reported UNC3886 backdoor and rootkit activity on Juniper routers, audit devices for unexpected processes, modified system files, or unusual persistence in the Junos shell. U.S. federal agencies must apply the required remediation per BOD 22-01 due to the KEV listing.