vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-59969

Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast packets will cause evo-aftmand / evo-pfemand to crash and restart

MEDIUM
6.5
CVSS Score
Published: April 9, 2026 at 09:25 PM UTC
Updated: October 7, 2026 at 09:10 AM UTC
19 products affected across 2 vendorsJunos OS EvolvedQfx5200Qfx5110

Using Junos OS Evolved by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS Evolved - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the advanced forwarding toolkit (evo-aftmand/evo-pfemand) of Juniper Networks Junos OS Evolved on PTX Series or QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS).An attacker sending crafted multicast packets will cause line cards running evo-aftmand/evo-pfemand to crash and restart or non-line card devices to crash and restart. Continued receipt and processing of these packets will sustain the Denial of Service (DoS) condition. This issue affects Junos OS Evolved PTX Series: * All versions before 22.4R3-S8-EVO, * from 23.2 before 23.2R2-S5-EVO, * from 23.4 before 23.4R2-EVO, * from 24.2 before 24.2R2-EVO, * from 24.4 before 24.4R2-EVO. This issue affects Junos OS Evolved on QFX5000 Series: * 22.2-EVO version before 22.2R3-S7-EVO, * 22.4-EVO version before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S5-EVO, * 24.2-EVO versions before 24.2R2-S1-EVO, * 24.4-EVO versions before 24.4R1-S3-EVO, 24.4R2-EVO. This issue does not affect Junos OS Evolved on QFX5000 Series versions before: 21.2R2-S1-EVO, 21.2R3-EVO, 21.3R2-EVO, 21.4R1-EVO, and 22.1R1-EVO.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos OS Evolved· Juniper
95%
v < 22.422.222.2 r122.2 r1-s122.2 r1-s222.2 r222.2 r2-s122.2 r2-s222.2 r322.2 r3-s122.2 r3-s222.2 r3-s322.2 r3-s422.2 r3-s522.2 r3-s622.422.4 r122.4 r1-s122.4 r1-s222.4 r222.4 r2-s122.4 r2-s222.4 r322.4 r3-s122.4 r3-s222.4 r3-s322.4 r3-s422.4 r3-s522.4 r3-s622.4 r3-s723.223.2 r123.2 r1-s123.2 r1-s223.2 r223.2 r2-s123.2 r2-s223.2 r2-s323.2 r2-s423.423.4 r123.4 r1-s123.4 r1-s223.4 r223.4 r2-s123.4 r2-s223.4 r2-s323.4 r2-s424.224.2 r124.2 r1-s224.2 r224.424.4 r124.4 r1-s224.4 r1-s324.4 r2
Affected range stops below 22.4, so it looks safe — our inference, not a vendor statement
juniper-ptx10001-36mr (environment) · juniper-ptx10002-36qdd (environment) · juniper-ptx10003 (environment) · juniper-ptx10004 (environment) · juniper-ptx10008 (environment) · juniper-ptx10016 (environment) · juniper-ptx12008 (environment) · juniper-qfx5110 (environment) · juniper-qfx5120 (environment) · juniper-qfx5130 (environment) · juniper-qfx5200 (environment) · juniper-qfx5210 (environment) · juniper-qfx5220 (environment) · juniper-qfx5230-64cd (environment) · juniper-qfx5240 (environment) · juniper-qfx5241 (environment) · juniper-qfx5700 (environment)
Junos OS Evolved· Juniper Networks
60%
v < 22.4R3-S8-EVO22.2 ≤ v < 22.2R3-S7-EVO22.4 ≤ v < 22.4R3-S7-EVO23.2 ≤ v < 23.2R2-S4-EVO23.2 ≤ v < 23.2R2-S5-EVO23.4 ≤ v < 23.4R2-EVO23.4 ≤ v < 23.4R2-S5-EVO24.2 ≤ v < 24.2R2-EVO24.2 ≤ v < 24.2R2-S1-EVO24.4 ≤ v < 24.4R1-S3-EVO, 24.4R2-EVO24.4 ≤ v < 24.4R2-EVO22.222.423.223.424.224.4
Affected range stops below 22.2R3-S7-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 22.4R3-S7-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 22.4R3-S8-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 23.2R2-S4-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 23.2R2-S5-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 23.4R2-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 23.4R2-S5-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 24.2R2-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 24.2R2-S1-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 24.4R1-S3-EVO, 24.4R2-EVO, so it looks safe — our inference, not a vendor statement
Affected range stops below 24.4R2-EVO, so it looks safe — our inference, not a vendor statement
Ptx10001-36Mr· Juniperdevice
80%
All versions
Ptx10002-36Qdd· Juniperdevice
80%
All versions
Ptx10003· Juniperdevice
80%
All versions
Ptx10004· Juniperdevice
80%
All versions
Ptx10008· Juniperdevice
80%
All versions
Ptx10016· Juniperdevice
80%
All versions
Ptx12008· Juniperdevice
80%
All versions
Qfx5110· Juniperdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

Vendor Advisory
Source: cverecord
https://kb.juniper.net/JSA103159

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMjuniper
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-120

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card