A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service (DoS).
When a user executes the 'show chassis' command with specifically crafted options, chassisd will crash and restart. Due to this all components but the Routing Engine (RE) in the chassis are reinitialized, which leads to a complete service outage, which the system automatically recovers from.
This issue affects:
Junos OS on MX, SRX and EX Series:
* all versions before 22.4R3-S8,
* 23.2 versions before 23.2R2-S5,
* 23.4 versions before 23.4R2-S6,
* 24.2 versions before 24.2R2-S2,
* 24.4 versions before 24.4R2.
Metrics
Affected Vendors & Products
References
History
Fri, 23 Jan 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Juniper
Juniper ex2300 Juniper ex2300-c Juniper ex3400 Juniper ex4000 Juniper ex4100 Juniper ex4100-f Juniper ex4100-h Juniper ex4300 Juniper ex4400 Juniper ex4600 Juniper ex4650 Juniper ex9204 Juniper ex9208 Juniper ex9214 Juniper junos Juniper mx10004 Juniper mx10008 Juniper mx2008 Juniper mx2010 Juniper mx2020 Juniper mx204 Juniper mx240 Juniper mx304 Juniper mx480 Juniper mx960 Juniper srx1500 Juniper srx1600 Juniper srx2300 Juniper srx300 Juniper srx320 Juniper srx340 Juniper srx345 Juniper srx380 Juniper srx4100 Juniper srx4120 Juniper srx4200 Juniper srx4300 Juniper srx4600 Juniper srx4700 Juniper srx5400 Juniper srx5600 Juniper srx5800 |
|
| CPEs | cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4000:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4100-f:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4100-h:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4100:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx304:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx1600:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx2300:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx4120:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx4300:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx4700:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:* cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:* cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s4:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s5:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s6:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3-s7:*:*:*:*:*:* cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r2-s3:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r2-s4:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2-s3:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2-s4:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2-s5:*:*:*:*:*:* cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.2:r2-s1:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.2:r2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:* cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:* |
|
| Vendors & Products |
Juniper
Juniper ex2300 Juniper ex2300-c Juniper ex3400 Juniper ex4000 Juniper ex4100 Juniper ex4100-f Juniper ex4100-h Juniper ex4300 Juniper ex4400 Juniper ex4600 Juniper ex4650 Juniper ex9204 Juniper ex9208 Juniper ex9214 Juniper junos Juniper mx10004 Juniper mx10008 Juniper mx2008 Juniper mx2010 Juniper mx2020 Juniper mx204 Juniper mx240 Juniper mx304 Juniper mx480 Juniper mx960 Juniper srx1500 Juniper srx1600 Juniper srx2300 Juniper srx300 Juniper srx320 Juniper srx340 Juniper srx345 Juniper srx380 Juniper srx4100 Juniper srx4120 Juniper srx4200 Juniper srx4300 Juniper srx4600 Juniper srx4700 Juniper srx5400 Juniper srx5600 Juniper srx5800 |
Fri, 16 Jan 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Juniper Networks
Juniper Networks junos Os |
|
| Vendors & Products |
Juniper Networks
Juniper Networks junos Os |
Thu, 15 Jan 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 15 Jan 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service (DoS). When a user executes the 'show chassis' command with specifically crafted options, chassisd will crash and restart. Due to this all components but the Routing Engine (RE) in the chassis are reinitialized, which leads to a complete service outage, which the system automatically recovers from. This issue affects: Junos OS on MX, SRX and EX Series: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S5, * 23.4 versions before 23.4R2-S6, * 24.2 versions before 24.2R2-S2, * 24.4 versions before 24.4R2. | |
| Title | Junos OS: A specifically crafted 'show chassis' command causes chassisd to crash | |
| Weaknesses | CWE-476 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: juniper
Published: 2026-01-15T20:16:22.617Z
Updated: 2026-01-15T21:10:13.435Z
Reserved: 2025-09-23T18:19:06.961Z
Link: CVE-2025-60007
Updated: 2026-01-15T21:10:08.169Z
Status : Analyzed
Published: 2026-01-15T21:16:03.780
Modified: 2026-01-23T19:39:36.860
Link: CVE-2025-60007
No data.
ReportizFlow