Junos OS CVE-2025-21590: Veriexec Bypass Used by UNC3886

What to do

1. Run show version on every Junos device and compare against the fixed releases, including the platform-specific list in JSA93446.
2. Upgrade to a fixed release; on SRX300, SRX550HM, EX4300, EX4600, ACX and MX104 use the specific builds the advisory names.
3. After upgrading, run request system malware-scan quick-scan and request system malware-scan integrity-check.
4. Remove the shell permission from every login class that does not need it and route admin access through centralized AAA with MFA.
5. Replace end-of-life MX hardware and software that can no longer take fixed images.

How to check if you are affected or compromised

• Run JMRT quick-scan and integrity-check (veriexec-check on Junos 19.2 to 21.3) on each Routing Engine.
• Search for connections to the Mandiant C2 addresses, e.g. 129.126.109[.]50, 116.88.34[.]184, 223.25.78[.]136 and 45.77.39[.]28 on TCP 22.
• Alert on ICMP payloads containing uSarguuS62bKRA0J and UDP traffic to port 33512 aimed at routers.
• Look for sed edits of /var/log/messages, /var/log/auth or /root/.history, gaps in logging or SNMP traps, and writes to /var/tmp/pfed_jdhcp6_trace.log.

What happened#

On March 12, 2025, Juniper published an out-of-cycle bulletin, JSA93446, for CVE-2025-21590. The bug is an improper isolation flaw in the Junos OS kernel. It lets a local attacker with shell access inject arbitrary code and compromise the device. Juniper scores it CVSS 4.0 6.7 (CVSS 3.1 4.4) because the attacker needs high privileges, and the bulletin says it "is not exploitable from the Junos CLI." Amazon's Matteo Memelli reported it during internal research. Juniper also said at least one instance of malicious exploitation had been reported to its SIRT.

That exploitation came from Mandiant. In mid-2024 it found UNC3886, a China-nexus espionage group, running TINYSHELL-based backdoors on Juniper MX routers with end-of-life hardware and software. Junos uses Veriexec to block unsigned binaries. The group logged in with legitimate credentials from a terminal server and dropped to the FreeBSD shell. It then used dd to write shellcode into the memory of a running cat process. Mandiant says this technique "is now tracked as CVE-2025-21590." Implants named appid, to, irad, lmpad, jdosd and oemd mimic Junos daemons. lmpad disables logging before the operator connects. CISA added the CVE to KEV on March 13, 2025.

Who is affected#

Junos OS before 21.2R3-S9, and 21.4, 22.2, 22.4, 23.2, 23.4 and 24.2 before their fixed releases (listed in the advisory). 24.4R1 and later are fixed. Affected platforms span MX, SRX, EX, QFX, ACX and NFX. Some platforms only got fixes in specific builds: SRX300, SRX550HM, EX4300, EX4600, several ACX models and MX104. Juniper later said 21.2R3-S9.20 was incomplete for those platforms, and 21.2R3-S9.21 carries the complete fix.

Do you really need to act?#

For most operators this is a verify-and-hunt job, not an emergency. The flaw does not give anyone access. It lets someone who already has a privileged shell defeat the integrity control that should stop them from running implants. UNC3886's real entry point was stolen or legitimate credentials. The risk is highest on old, unmonitored routers that cannot take current images, which is exactly what Mandiant found.

What to do now#

1. Inventory versions with show version on every Junos device and compare against JSA93446, including its platform-specific list.
2. Upgrade to a fixed release. Replace end-of-life MX hardware that cannot run one.
3. After upgrading, run Juniper's Malware Removal Tool: request system malware-scan quick-scan and request system malware-scan integrity-check (named veriexec-check on 19.2 to 21.3).
4. Restrict shell access, which is Juniper's interim mitigation. Remove the shell permission from login classes that don't need it, and put device logins behind centralized AAA with MFA.
5. Rotate local and TACACS+/RADIUS credentials if you can't vouch for everyone who held them.

How to tell if you were hit#

JMRT is signature-based, so pair it with network evidence. Mandiant lists C2 servers on TCP 22, including 129.126.109[.]50, 116.88.34[.]184, 223.25.78[.]136 and 45.77.39[.]28. It also lists ICMP packets carrying the string uSarguuS62bKRA0J (used to trigger irad) and UDP to port 33512 (jdosd). On the device, look for sed edits to /var/log/messages, /var/log/auth or /root/.history, and for writes to /var/tmp/pfed_jdhcp6_trace.log. Unexplained gaps in syslog, SNMP traps or audit logs are also a sign. Mandiant also publishes YARA and Snort rules. If anything matches, treat the router as compromised. Reimage it from known-good media and rotate every credential it stored.

Timeline#

• Mar 11, 2025 — Mandiant publishes its UNC3886 Juniper research.
• Mar 12, 2025 — Juniper publishes JSA93446 and fixed releases.
• Mar 13, 2025 — CISA adds CVE-2025-21590 to KEV (due Apr 3, 2025).
• Apr 14, 2025 — Juniper says 21.2R3-S9.20 is incomplete on listed platforms.
• May 6, 2025 — 21.2R3-S9.21 ships with the complete fix.

Vulnerability records

• CVE-2025-21590 · KEV 2025-03-13 · An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Juniper Networks — JSA93446: Junos OS: A local attacker with shell access can execute arbitrary code (CVE-2025-21590) supportportal.juniper.net
2. CVE record — CVE-2025-21590 cve.org
3. NVD — CVE-2025-21590 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-21590 cisa.gov
5. Mandiant (Google Cloud) — Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers cloud.google.com
6. Juniper Networks — Using the Juniper Malware Removal Tool juniper.net

Coverage and analysis

1. BleepingComputer — Juniper patches bug that let Chinese cyberspies backdoor routers bleepingcomputer.com