CVE-2025-30661

An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileged user to install scripts to be executed as root, leading to privilege escalation. A local user with access to the local file system can copy a script to the router in a way that will be executed as root, as the system boots. Execution of the script as root can lead to privilege escalation, potentially providing the adversary complete control of the system. This issue only affects specific line cards, such as the MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C. This issue affects Junos OS: * from 23.2 before 23.2R2-S4, * from 23.4 before 23.4R2-S5, * from 24.2 before 24.2R2-S1, * from 24.4 before 24.4R1-S3, 24.4R2. This issue does not affect versions prior to 23.1R2.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/orangecertcc/security-research/security/advisories/GHSA-2p66-9j7x-fmch
https://supportportal.juniper.net/JSA100057

Configurations

No configuration.

History

15 Jul 2025, 13:14

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 15:15

Updated : 2025-07-15 13:14

NVD link : CVE-2025-30661

Mitre link : CVE-2025-30661

CVE.ORG link : CVE-2025-30661

JSON object : View

Products Affected

No product.

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2025-30661", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.5, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-11T15:15:24.073", "references": [{"url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-2p66-9j7x-fmch", "source": "sirt@juniper.net"}, {"url": "https://supportportal.juniper.net/JSA100057", "source": "sirt@juniper.net"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a local, low-privileged user to install scripts to be executed as root, leading to privilege escalation.\n\nA local user with access to the local file system can copy a script to the router in a way that will be executed as root, as the system boots. Execution of the script as root can lead to privilege escalation, potentially providing the adversary complete control of the system.\n\nThis issue only affects specific line cards, such as the MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700, and EX9200-15C.\n\nThis issue affects Junos OS: * from 23.2 before 23.2R2-S4,\u00a0\n * from 23.4 before 23.4R2-S5,\u00a0\n * from 24.2 before 24.2R2-S1,\u00a0\n * from 24.4 before 24.4R1-S3, 24.4R2.\n\n\n\n\n\n\nThis issue does not affect versions prior to 23.1R2."}, {"lang": "es", "value": "Una vulnerabilidad de asignaci\u00f3n incorrecta de permisos para recursos cr\u00edticos en el procesamiento de scripts de tarjetas de l\u00ednea de Juniper Networks Junos OS permite que un usuario local con pocos privilegios instale scripts para su ejecuci\u00f3n como root, lo que provoca una escalada de privilegios. Un usuario local con acceso al sistema de archivos local puede copiar un script al router para que se ejecute como root al iniciar el sistema. La ejecuci\u00f3n del script como root puede provocar una escalada de privilegios, lo que podr\u00eda otorgar al atacante el control total del sistema. Este problema solo afecta a tarjetas de l\u00ednea espec\u00edficas, como MPC10, MPC11, LC4800, LC9600, MX304-LMIC16, SRX4700 y EX9200-15C. Este problema afecta a Junos OS: * de la versi\u00f3n 23.2 anterior a 23.2R2-S4, * de la versi\u00f3n 23.4 anterior a 23.4R2-S5, * de la versi\u00f3n 24.2 anterior a 24.2R2-S1, * de la versi\u00f3n 24.4 anterior a 24.4R1-S3, 24.4R2. Este problema no afecta a las versiones anteriores a 23.1R2."}], "lastModified": "2025-07-15T13:14:49.980", "sourceIdentifier": "sirt@juniper.net"}