---
title: "Junos OS CVE-2025-21590: Veriexec Bypass Used by UNC3886"
url: https://erroneo.us/security/briefs/juniper-junos-cve-2025-21590-veriexec-bypass-unc3886/
description: "Junos kernel flaw let a China-nexus group plant backdoors on old MX routers via the shell. Fixed in 21.2R3-S9, 22.4R3-S6, 24.2R2 and later. Patch, run JMRT."
type: security-brief
section: "Security Digest"
date_published: 2025-03-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-21590"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Junos OS CVE-2025-21590: Veriexec Bypass Used by UNC3886

**Verdict: Check exposure.** A shell-only flaw used by a state espionage group against old MX routers: confirm every Junos device is on a fixed release, run Juniper's malware scan, and retire end-of-life routers.

- **Who must act:** Operators of Juniper routers and switches on Junos OS older than the fixed releases, above all end-of-life MX hardware and devices where many people or tools hold shell-capable credentials.
- **Who can relax:** Teams on fixed releases whose admin access is centralized, MFA-protected and shell-restricted; this is not reachable from the Junos CLI or the network on its own.
- **Affected:** Junos OS before 21.2R3-S9; 21.4 before 21.4R3-S10; 22.2 before 22.2R3-S6; 22.4 before 22.4R3-S6; 23.2 before 23.2R2-S3; 23.4 before 23.4R2-S4; 24.2 before 24.2R1-S2 / 24.2R2
- **Fixed:** 21.2R3-S9 (21.2R3-S9.21 for the platforms listed in the advisory); 21.4R3-S10; 22.2R3-S6; 22.4R3-S6; 23.2R2-S3; 23.4R2-S4; 24.2R1-S2 / 24.2R2; 24.4R1 and later
- **CVEs:** CVE-2025-21590
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run show version on every Junos device and compare against the fixed releases, including the platform-specific list in JSA93446.
2. Upgrade to a fixed release; on SRX300, SRX550HM, EX4300, EX4600, ACX and MX104 use the specific builds the advisory names.
3. After upgrading, run request system malware-scan quick-scan and request system malware-scan integrity-check.
4. Remove the shell permission from every login class that does not need it and route admin access through centralized AAA with MFA.
5. Replace end-of-life MX hardware and software that can no longer take fixed images.

### How to check if you are affected

- Run JMRT quick-scan and integrity-check (veriexec-check on Junos 19.2 to 21.3) on each Routing Engine.
- Search for connections to the Mandiant C2 addresses, e.g. 129.126.109[.]50, 116.88.34[.]184, 223.25.78[.]136 and 45.77.39[.]28 on TCP 22.
- Alert on ICMP payloads containing uSarguuS62bKRA0J and UDP traffic to port 33512 aimed at routers.
- Look for sed edits of /var/log/messages, /var/log/auth or /root/.history, gaps in logging or SNMP traps, and writes to /var/tmp/pfed_jdhcp6_trace.log.

## What happened

On March 12, 2025, Juniper published an out-of-cycle bulletin, [JSA93446](https://supportportal.juniper.net/JSA93446), for [CVE-2025-21590](https://www.cve.org/CVERecord?id=CVE-2025-21590). The bug is an improper isolation flaw in the Junos OS kernel. It lets a local attacker with shell access inject arbitrary code and compromise the device. Juniper scores it CVSS 4.0 6.7 (CVSS 3.1 4.4) because the attacker needs high privileges, and the bulletin says it "is not exploitable from the Junos CLI." Amazon's Matteo Memelli reported it during internal research. Juniper also said at least one instance of malicious exploitation had been reported to its SIRT.

That exploitation came from [Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers). In mid-2024 it found UNC3886, a China-nexus espionage group, running TINYSHELL-based backdoors on Juniper MX routers with end-of-life hardware and software. Junos uses Veriexec to block unsigned binaries. The group logged in with legitimate credentials from a terminal server and dropped to the FreeBSD shell. It then used `dd` to write shellcode into the memory of a running `cat` process. Mandiant says this technique "is now tracked as CVE-2025-21590." Implants named `appid`, `to`, `irad`, `lmpad`, `jdosd` and `oemd` mimic Junos daemons. `lmpad` disables logging before the operator connects. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21590) on March 13, 2025.

## Who is affected

Junos OS before 21.2R3-S9, and 21.4, 22.2, 22.4, 23.2, 23.4 and 24.2 before their fixed releases (listed in the advisory). 24.4R1 and later are fixed. [Affected platforms](https://www.bleepingcomputer.com/news/security/juniper-patches-bug-that-let-chinese-cyberspies-backdoor-routers-since-mid-2024/) span MX, SRX, EX, QFX, ACX and NFX. Some platforms only got fixes in specific builds: SRX300, SRX550HM, EX4300, EX4600, several ACX models and MX104. Juniper later said 21.2R3-S9.20 was incomplete for those platforms, and 21.2R3-S9.21 carries the complete fix.

## Do you really need to act?

For most operators this is a verify-and-hunt job, not an emergency. The flaw does not give anyone access. It lets someone who already has a privileged shell defeat the integrity control that should stop them from running implants. UNC3886's real entry point was stolen or legitimate credentials. The risk is highest on old, unmonitored routers that cannot take current images, which is exactly what Mandiant found.

## What to do now

1. Inventory versions with `show version` on every Junos device and compare against JSA93446, including its platform-specific list.
2. Upgrade to a fixed release. Replace end-of-life MX hardware that cannot run one.
3. After upgrading, run Juniper's [Malware Removal Tool](https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/using-the-juniper-malware-removal-tool.html): `request system malware-scan quick-scan` and `request system malware-scan integrity-check` (named `veriexec-check` on 19.2 to 21.3).
4. Restrict shell access, which is Juniper's interim mitigation. Remove the `shell` permission from login classes that don't need it, and put device logins behind centralized AAA with MFA.
5. Rotate local and TACACS+/RADIUS credentials if you can't vouch for everyone who held them.

## How to tell if you were hit

JMRT is signature-based, so pair it with network evidence. Mandiant lists C2 servers on TCP 22, including `129.126.109[.]50`, `116.88.34[.]184`, `223.25.78[.]136` and `45.77.39[.]28`. It also lists ICMP packets carrying the string `uSarguuS62bKRA0J` (used to trigger `irad`) and UDP to port 33512 (`jdosd`). On the device, look for `sed` edits to `/var/log/messages`, `/var/log/auth` or `/root/.history`, and for writes to `/var/tmp/pfed_jdhcp6_trace.log`. Unexplained gaps in syslog, SNMP traps or audit logs are also a sign. Mandiant also publishes YARA and Snort rules. If anything matches, treat the router as compromised. Reimage it from known-good media and rotate every credential it stored.

## Timeline

- Mar 11, 2025 — Mandiant publishes its UNC3886 Juniper research.
- Mar 12, 2025 — Juniper publishes JSA93446 and fixed releases.
- Mar 13, 2025 — CISA adds CVE-2025-21590 to KEV (due Apr 3, 2025).
- Apr 14, 2025 — Juniper says 21.2R3-S9.20 is incomplete on listed platforms.
- May 6, 2025 — 21.2R3-S9.21 ships with the complete fix.

## Sources

1. [Juniper Networks — JSA93446: Junos OS: A local attacker with shell access can execute arbitrary code (CVE-2025-21590)](https://supportportal.juniper.net/JSA93446)
2. [CVE record — CVE-2025-21590](https://www.cve.org/CVERecord?id=CVE-2025-21590)
3. [NVD — CVE-2025-21590](https://nvd.nist.gov/vuln/detail/CVE-2025-21590)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-21590](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-21590)
5. [Mandiant (Google Cloud) — Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers](https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers)
6. [Juniper Networks — Using the Juniper Malware Removal Tool](https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/using-the-juniper-malware-removal-tool.html)
7. [BleepingComputer — Juniper patches bug that let Chinese cyberspies backdoor routers](https://www.bleepingcomputer.com/news/security/juniper-patches-bug-that-let-chinese-cyberspies-backdoor-routers-since-mid-2024/)

---
Source page: https://erroneo.us/security/briefs/juniper-junos-cve-2025-21590-veriexec-bypass-unc3886/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt