- Juniper Networks has patched a vulnerability in its routers
- The error was abused by Chinese threat players
- Multiple units were vulnerable
Juniper Networks has released a patch for a vulnerability that was exploited in nature to attack some of its router marks.
According to the company’s security advice, the error is incorrect insulation or part of the room and it is traced as CVE-2025-21590. It got a severity of 6.7 (medium).
The error is used by Chinese hackers who had exploited it since 2024 to become vulnerable Juniper routers reaching the end of life, revealed a recent Madiant Security report.
Chinese hackers
“By mid -2024, Mandiant discovered threat actors who deployed custom back doors operating on Einer Networks’ Junos OS routers,” explained Cybersecurity Company. “Mandiant attributed these back doors to the China-Nexus-SPIAGE group, UNC3886. Mandiant revealed several small-based back doors operating on Juniper Networks’ Junos OS routers.”
UNC3886 was observed in the past targeted defense, technology and telecommunications organizations with sophisticated malware inserted through zero-day vulnerabilities.
It affects at least these models: NFX series, Virtual SRX, SRX series branch, SRX series HE, EX-Series, QFX series, ACX and MX series, but EinerNetwork said it is still investigating vulnerability and the full list could be different.
The error can be exploited to allow local attackers with high privileges to run arbitrary code on the routers and thus compromise them.
“At least one case of malicious exploitation (not at Amazon) has been reported to Juniper Sirt,” Juniper said in his advice. “Customers are encouraged to upgrade to a fixed release as soon as it is available and in the meantime take steps to reduce this vulnerability.”
The problem was solved in 21.4R3-S10, 22.2R3-S6, 22.4R3-S6, 23.2R2-S3, 24.2R1-S2, 24.2R2, 24.4R1 and all subsequent releases.
At the same time, CISA added the mistake to its known utilized vulnerability catalog (KEV), which confirmed reports of abuse of wild and gave the Federal Civilian Executive Branch (FCCEB) agencies three weeks to apply patch or stop using vulnerable solutions.
Via Bleeping computer
