CVE-2025-21601 Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "J-Web",
      "Captive Portal",
      "802.1X",
      "Juniper Secure Connect (JSC)",
      "Firewall Authentication"
    ],
    "packageName": "AppWeb",
    "platforms": [
      "SRX Series",
      "EX Series",
      "MX240",
      "MX480",
      "MX960",
      "QFX5120 Series"
    ],
    "product": "Junos OS",
    "programRoutines": [
      {
        "name": "Mbedthis AppWeb"
      }
    ],
    "repo": "https://www.embedthis.com/appweb",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "21.4R3-S9",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "22.2R3-S5",
        "status": "affected",
        "version": "22.2",
        "versionType": "semver"
      },
      {
        "lessThan": "22.4R3-S4",
        "status": "affected",
        "version": "22.4",
        "versionType": "semver"
      },
      {
        "lessThan": "23.2R2-S3",
        "status": "affected",
        "version": "23.2",
        "versionType": "semver"
      },
      {
        "lessThan": "23.4R2-S3",
        "status": "affected",
        "version": "23.4",
        "versionType": "semver"
      },
      {
        "lessThan": "24.2R1-S1, 24.2R2",
        "status": "affected",
        "version": "24.2",
        "versionType": "semver"
      }
    ]
  }
]