🟢 CVE-2025-21590

CVE-2025-21590 is a local privilege escalation vulnerability in Juniper Junos OS that requires high privileges and shell access to exploit. Despite being in CISA KEV due to active exploitation, it cannot be directly exploited from the internet as it requires LOCAL attack vector and existing high-privilege access to the device shell.

← Back to Overview
LOW_RISK
Risk Level
4.4
CVSS Score
LOCAL
Attack Vector
Privilege Escalation
ATT&CK Tactic
T1068 — Exploitation for Privilege Escalation
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2025-03-12

Added to CISA KEV: 2025-03-13 1 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2025-21590 is a critical vulnerability in the kernel of Juniper Networks' Junos OS, characterized as an "Improper Isolation or Compartmentalization" flaw [2] [5].

Exploitation and Threat Actor Usage
  • Active Exploitation: The vulnerability has been exploited in the wild [1].
  • Threat Actor: It has been linked to the China-nexus threat actor known as UNC3886 as part of a campaign referred to as "RedPenguin" [1].
  • Nature of Attacks: The flaw was used to install persistent, stealthy rootkits on carrier-grade routers, effectively turning network infrastructure into platforms for espionage [1]. It is important to note that the initial discovery of the vulnerability by Amazon was the result of internal security research, not exploitation [3].
Attack Method and Requirements
  • Access Level: Exploitation requires a local attacker with high privileges who already has access to the device's shell [2] [5].
  • Exploitation Vector: The vulnerability is not exploitable via the Junos CLI [2].
  • Mechanism: Successful exploitation allows an attacker to bypass the Veriexec integrity subsystem, enabling the injection and execution of arbitrary code [1].
Impact
  • Successful exploitation results in the compromise of the device's integrity [2]. By bypassing integrity checks, attackers can maintain persistence and operate stealthily within the network infrastructure [1].
Affected Versions and Mitigation
Juniper Networks released security updates to address this issue. The vulnerability affects various versions of Junos OS, including but not limited to:
  • All versions before 21.2R3-S9
  • 21.4 versions before 21.4R3-S10
  • 22.2 versions before 22.2R3-S6
  • 22.4 versions before 22.4R3-S6
  • 23.2 versions before 23.2R2-S3 (and others in the 23.x branch) [4]
Users are advised to consult the official [Juniper Networks Security Bulletin](https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-Bulletin-Junos-OS-A-local-attacker-with-shell-access-can-execute-arbitrary-code-CVE-2025-21590) for the complete list of affected versions and to apply the necessary patches.

Sources

  1. CVE-2025-21590: The RedPenguin Kernel Bypass - CVEReports

    A critical improper isolation vulnerability in the Juniper Networks Junos OS kernel allows local attackers to bypass the Veriexec integrity subsystem. Exploited in the wild by the China-nexus threat actor UNC3886 as part of the RedPenguin campaign, this flaw enables the installation of persistent, s…

  2. CVE-2025-21590 Detail - NVD

    A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos ... CVE-2025-21590 Detail Description An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos O…

  3. 2025-03 Out-of-Cycle Security Bulletin: Junos OS: A local attacker ...

    2025-03 Out-of-Cycle Security Bulletin: Junos OS: A local attacker with shell access can execute arbitrary code (CVE-2025-21590). Article ID ... Related Information CVE-2025-21590 Acknowledgements Juniper SIRT would like to acknowledge and thank Matteo Memelli from Amazon for responsibly reporting t…

  4. An Improper Isolation or Compartmentalization... · CVE-2025-21590 ...

    A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS: All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 vers…

  5. CVE-2025-21590: Deep Dive into the Junos OS Improper Isolation...

    CVE-2025-21590 is an Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks' Junos OS. This vulnerability allows a local attacker with high privileges to execute arbitrary code, compromising the integrity of the affected device.Google Cloud Blog: Ghost in the Rout…

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed