RCE in Juniper Junos Os Evolved
CVE-2025-60006
Multiple instances of an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and/or execute unauthorized commands. When an attacker executes crafted CLI commands, the options are processed via a script in some cases. These scripts are not hardened so injected commands might be executed via the shell, which allows an attacker to perform operations, which they should not be able to do according to their assigned permissions. This issue affects Junos OS Evolved: * 24.2 versions before 24.2R2-S2-EVO, * 24.4 versions before 24.4R2-EVO. This issue does not affect Junos OS Evolved versions earlier than 24.2R1-EVO.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.010 (59.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Juniper Junos_os_evolved — versions 24.2, 24.4
- Juniper Networks Junos Os Evolved — versions 24.2, 24.4, 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- sirt@juniper.net (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-60006?
- CVE-2025-60006 is a medium-severity vulnerability in Juniper Junos Os Evolved, classified under OS Command Injection. CVSS score: 5.3/10. Published 2025-10-09.
- How severe is CVE-2025-60006?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2025-60006 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.