Juniper Junos OS: Improper delimiter neutralization allows config tampering
CVE-2025-52989 Published on July 11, 2025

Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration
An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration. A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration. This issue affects: Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S7, * 23.2 versions before 23.2R2-S4, * 23.4 versions before 23.4R2-S4, * 24.2 versions before 24.2R2-S1, * 24.4 versions before 24.4R1-S2, 24.4R2; Junos OS Evolved: * all versions before 22.4R3-S7-EVO, * 23.2-EVO versions before 23.2R2-S4-EVO, * 23.4-EVO versions before 23.4R2-S5-EVO, * 24.2-EVO versions before 24.2R2-S1-EVO * 24.4-EVO versions before 24.4R2-EVO.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-52989 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and a small impact on availability.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

HIGH

Availability Impact:

LOW

Weakness Type

Improper Neutralization of Delimiters

The software does not neutralize or incorrectly neutralizes delimiters.

Products Associated with CVE-2025-52989

stack.watch emails you whenever new vulnerabilities are published in Juniper Networks Junos or Juniper Networks Junos Os Evolved. Just hit a watch button to start following.

Juniper Networks Junos

Juniper Networks Junos Os Evolved

Affected Versions

Juniper Networks Junos OS:

Before 22.2R3-S7 is affected.
Version 22.4 and below 22.4R3-S7 is affected.
Version 23.2 and below 23.2R2-S4 is affected.
Version 23.4 and below 23.4R2-S4 is affected.
Version 24.2 and below 24.2R2-S1 is affected.
Version 24.4 and below 24.4R1-S2, 24.4R2 is affected.

Juniper Networks Junos OS Evolved:

Before 22.4R3-S7-EVO is affected.
Version 23.2-EVO and below 23.2R2-S4-EVO is affected.
Version 23.4-EVO and below 23.4R2-S5-EVO is affected.
Version 24.2-EVO and below 24.2R2-S1-EVO is affected.
Version 24.4-EVO and below 24.4R2-EVO is affected.

Exploit Probability

EPSS

0.02%

Percentile

4.08%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.