CVE-2025-52982
Severity CVSS v4.0:
HIGH
Type:
CWE-404
Improper Resource Shutdown or Release
Publication date:
11/07/2025
Last modified:
11/07/2025
Description
An Improper Resource Shutdown or Release vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br />
<br />
When an MX Series device with an MS-MPC is configured with two or more service sets which are both processing SIP calls, a specific sequence of call events will lead to a crash and restart of the MS-MPC.<br />
This issue affects Junos OS:<br />
<br />
<br />
<br />
* all versions before 21.2R3-S9,<br />
* 21.4 versions from 21.4R1,<br />
* 22.2 versions before 22.2R3-S6,<br />
* 22.4 versions before 22.4R3-S6.<br />
<br />
<br />
<br />
<br />
As the MS-MPC is EoL after Junos OS 22.4, later versions are not affected.<br />
<br />
This issue does not affect MX-SPC3 or SRX Series devices.
Impact
Base Score 4.0
8.20
Severity 4.0
HIGH
Base Score 3.x
5.90
Severity 3.x
MEDIUM