Juniper Junos OS Privilege Escalation via Annotate Command (CVE-2025-52989)

Critical Vulnerability Information Vulnerability Overview CVE ID: CVE-2025-52989 Title: Junos OS and Junos OS Evolved: Annotate configuration command can be used for privilege escalation Advisory ID: JSA100096 Release Date: 2025-07-09 Update Date: 2025-07-09 Affected Products Affected Versions: - Junos OS: All versions - Junos OS Evolved: All versions Issue Description Vulnerability Type: Improper Neutralization of Delimiters Impact: Allows a local, authenticated, high-privileged attacker to modify system configuration. Users with limited configuration and commit permissions can exploit a carefully crafted annotation configuration command to modify any part of the device configuration. Solution Fixed Versions: - Junos OS Evolved: 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S5-EVO, 24.2R2-S1-EVO, 24.4R2-EVO, 25.2R1-EVO - Junos OS: 22.4R3-S7, 23.2R3-S7, 23.2R2-S4, 23.4R2-S5, 24.2R2-S1, 24.4R1-S2, 24.4R2, 25.2R1 and later versions Mitigation Measures Restrict CLI access using access control lists or firewall filters, allowing access only from trusted hosts and administrators. Disable execution of the command via CLI authorization. Severity Assessment CVSS Score: v3.1: 5.1, v4.0: 6.8 Severity Level: Medium Related Information Related Documentation: - KB16462: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process - KB16476: In which releases are vulnerabilities fixed? - KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories - Reporting Security Vulnerabilities: How to Contact Juniper Networks Security Incident Response Team

Goal Reached Thanks to every supporter — we hit 100%!

Juniper Junos OS Privilege Escalation via Annotate Command (CVE-2025-52989)