CVE-2025-21590
Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability
Description
CVE-2025-21590 is a medium-severity improper isolation vulnerability in the kernel of Juniper Networks Junos OS that allows a local attacker with high privileges and shell access to inject arbitrary code, compromising the integrity of the device. While the vulnerability requires local access and elevated privileges, it has been exploited in the wild by China-nexus espionage actors targeting Juniper routers as part of advanced persistent threat (APT) campaigns. With a CVSS v3.1 score of 4.4 and an EPSS score of 0.89% at the 75th percentile, CISA has added CVE-2025-21590 to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | <= 21.2; 21.2; 21.4; 22.2; 22.4; 23.2; 23.4; 24.2 |
References
- https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers(Third Party Advisory)
- https://supportportal.juniper.net/JSA93446(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21590(US Government Resource)
Weakness Type
CWE-653: Improper Isolation or Compartmentalization
CVE-2025-21590 is classified under CWE-653 (Improper Isolation or Compartmentalization), a weakness where an application fails to properly separate components or processes that should be isolated from each other. In the Junos OS kernel, insufficient compartmentalization allows a privileged user with shell access to break out of the intended execution boundaries and inject arbitrary code into the device's runtime environment. This bypasses the normal separation between the administrative shell and the kernel's protected execution context.
Learn more: CWE-653 — Improper Isolation or Compartmentalization
Impact Analysis
CVE-2025-21590 has a targeted but significant impact, particularly in the context of state-sponsored espionage. The vulnerability requires local access (AV:L) with high privileges (PR:H) and no user interaction (UI:N), limiting the attack to scenarios where an adversary has already gained shell access to a Juniper router. Integrity (High) is the primary impact, as successful exploitation allows injection of arbitrary code that can modify the device's behavior, install persistent implants, intercept network traffic, or alter routing configurations. Confidentiality and availability are not directly impacted according to the CVSS vector, but the ability to inject code into a network routing device has profound implications for network security. The Google Threat Intelligence report confirms this vulnerability was used by China-nexus espionage actors, demonstrating that even medium-severity vulnerabilities in network infrastructure are actively exploited when they enable persistence on high-value targets.
Exploit Maturity
CVE-2025-21590 has confirmed active exploitation by state-sponsored threat actors. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 3, 2025. The Google Cloud Threat Intelligence report documents that China-nexus espionage actors specifically targeted Juniper routers using this vulnerability to install persistent implants for long-term intelligence collection. While the EPSS score of 0.89% at the 75th percentile suggests moderate exploitation probability in broad terms, the confirmed APT usage makes this vulnerability critical for organizations operating Juniper routers in sensitive environments. The vulnerability is not exploitable from the Junos CLI, requiring shell access, which limits the attack surface but does not reduce the severity for already-compromised devices.
Remediation
-
Upgrade Junos OS to a patched version immediately. The following versions address CVE-2025-21590: 21.2R3-S9 or later, 21.4R3-S10 or later, 22.2R3-S6 or later, 22.4R3-S6 or later, 23.2R2-S3 or later, 23.4R2-S4 or later, and 24.2R1-S2 or 24.2R2 or later. Refer to the Juniper security advisory JSA93446 for complete upgrade guidance.
-
Restrict shell access to Junos devices to the absolute minimum number of administrators required. Disable shell access for accounts that do not need it, use RBAC (Role-Based Access Control) to limit privilege levels, and enforce strong authentication for any remaining shell access.
-
Conduct integrity verification on all Juniper routers running affected versions, especially those in sensitive network positions. Check for unauthorized modifications to the operating system, configuration files, and installed software. Look for persistent implants or backdoors that may have been installed through this vulnerability.
-
Implement enhanced monitoring for Juniper device integrity. Deploy file integrity monitoring (FIM) on device filesystems, monitor for unexpected process creation or kernel module loading, and configure alerts for shell access events. Review the Google Threat Intelligence report for specific indicators of compromise associated with China-nexus exploitation.
-
Enforce network segmentation for management plane access to all Juniper routers. Management interfaces should only be accessible from dedicated out-of-band management networks, and all administrative sessions should be logged and monitored.
Technical Details
CVE-2025-21590 is an improper isolation vulnerability in the Juniper Networks Junos OS kernel affecting a wide range of versions: all versions before 21.2R3-S9, 21.4 before 21.4R3-S10, 22.2 before 22.2R3-S6, 22.4 before 22.4R3-S6, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, and 24.2 before 24.2R1-S2 or 24.2R2. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N reflects that the attack requires local shell access with high privileges but has low complexity once those prerequisites are met. The vulnerability is specifically not exploitable from the Junos CLI — an attacker must have operating system shell access. The kernel's compartmentalization mechanism fails to properly isolate the shell environment from protected kernel execution contexts, allowing a privileged user to inject arbitrary code that executes within the kernel's trust boundary. This code injection capability enables installation of persistent implants that survive reboots and can intercept, modify, or redirect network traffic passing through the router.
Frequently Asked Questions
Is CVE-2025-21590 being actively exploited?
Yes. Google Threat Intelligence has documented exploitation by China-nexus espionage actors targeting Juniper routers, and CISA has confirmed active exploitation by adding it to the KEV catalog. The attacks involved installing persistent implants for long-term intelligence collection.
What products are affected by CVE-2025-21590?
Juniper Networks Junos OS across multiple version branches is affected: all versions before 21.2R3-S9, 21.4 before 21.4R3-S10, 22.2 before 22.2R3-S6, 22.4 before 22.4R3-S6, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, and 24.2 before 24.2R1-S2.
How do I fix CVE-2025-21590?
Upgrade to a patched Junos OS version as specified in Juniper advisory JSA93446. Additionally, restrict shell access to Juniper devices and conduct integrity verification to check for unauthorized modifications or implants.
How severe is CVE-2025-21590?
CVE-2025-21590 is rated Medium with a CVSS score of 4.4, reflecting the requirement for local, high-privilege access. However, its confirmed use by state-sponsored espionage actors makes it critical for organizations in sensitive sectors, as compromised routers can enable persistent network surveillance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.