Juniper Junos OS Vulnerability (JSA100060)

#TRUSTED 87d468bafcb4e8b354eef8e45f58c01eba504b5a05f3f16367e021a42b49fc0c6accc7c1ebd0d972152971e1651e9d025c9e60146ac67929eac2a1aa03b493f5b382f3bfd7e9929e0a68c1f48420a43f84b761d674962b161a882fe429a947d335f7425120c7b60c97dd5d7d7144e0e8ded365c1663e4ed93f3acaa2a50619c2ba9a192cb139e0d28159194d0a21ce955d3d9d0012797691f7296a28f66669c7dc94e9ab46e84413535302f28c91d7ab8d33ba585785ade59f208cee433d8da988144c82c42c1a7e1f80ec5823612b3e6c74b90391054ef4b5197f035b114b2c8abf844a812b28d4c29e6ccf5b10f33eaaf95d6ab32213c6a906913ff667e1590b7e4fdb7b4ab5b392e1ad8ad05ec88b57840a1042be466377c9f3358f9c439a426be41bf681ebe7300a4c2d486a8b35512a299ab41b258ef0e38f3281b5f0aee04012ac7196b9faa648b5fa5027d3378432b154e1cf2a9abcb1f99032526e45481976dacafdc41e9972712d253df7711143e45192aa516adf0a1b15dfbc0c0698aed7102bc7039f060e26c33350e31e17dc9907db00b27629fd2666be1b4a338e89bc8f43cc77118646a2b51cde9246d002d9fbd57a78b96eebcd1e82401629af61cbb315d7d4d31ded89c3373851f6a4a61d10248ae817e0666a0b51cbc72496094fbbcda7ef6ccc2115a8bf8aa8db1bdcf0b881f883787be99865aa87e4a3
#TRUST-RSA-SHA256 41eb16dcbfa83e826e57a36cda78337ada74d6d55f2b75a4c23c91b3c6da26cae26220100dd48df79998bc77b76860c4e66cbb4a866c013e5fc8a9a8d50ba2e79a2b113ed3623f984f2c4bad7f567175b609a2135441286f87388c3f8d601f768861d55e69153487f8d1b8f4a7632dea6a8176fbe331b3f1731ed6027d9e50187a2cb864987fdfcd10207e1b8841baf97d6257d8fd616fc7442f22a2d3d39dd8ee805a1b1af54d8dcdb8417266b063638dc6edd5e7596abe3ccf923953efb77143b4b9409898ec7963dd3e780f472a2f5749ad192d866f93a7d6d40b42a5a2bc2217f089368ca799fd2e29ec2d8879acbee6f4ab450870c3c12775897f97513c2c7d76af9522ceb0ddcc17868da7f7dee8b73764464b95cad9469d168e371af0e9c2a5b06e3df76b6473aa042a2577b45f58c4e055ea532931491e7ae975a91c7724c6dbdbcc63383eaf03f96f97da1de20c7c68904a0a23bdbce81e2a85bba4b0004567db6ea5461c146b28e71ecc90ae3fc85757b9bf773fc0e1dbdb2cb76d0aa76523637ebc09389730bb6b4bb59f42f61119b8fa975ae639f79727a8f01ca374102fe81fdcce0e83e244ef10031e7466fc61ee79fd8171b7c7e8606aaf9e461db12c69a182e9f87e62d95137047132e3aaa320bb45417c3ec35c092f356dbac4909462df0cd1b18b6a204c5e20a5dd361f22e8a7e6f35a80040937adf31c
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242614);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/23");

  script_cve_id("CVE-2025-52954");
  script_xref(name:"JSA", value:"JSA100060");
  script_xref(name:"IAVA", value:"2025-A-0510");

  script_name(english:"Juniper Junos OS Vulnerability (JSA100060)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100060
advisory.

  - A Missing Authorization vulnerability in the internal virtual routing and forwarding (VRF) of Juniper
    Networks Junos OS Evolved allows a local, low-privileged user to gain root privileges, leading to a system
    compromise. (CVE-2025-52954)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-07-Security-Bulletin-Junos-OS-Evolved-A-low-privileged-user-can-execute-CLI-commands-and-modify-the-configuration-compromise-the-system-CVE-2025-52954
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?23218f90");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA100060");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-52954");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/23");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0-EVO', 'fixed_ver':'22.2R3-S7-EVO'},
  {'min_ver':'22.4-EVO', 'fixed_ver':'22.4R3-S7-EVO'},
  {'min_ver':'23.2-EVO', 'fixed_ver':'23.2R2-S4-EVO'},
  {'min_ver':'23.4-EVO', 'fixed_ver':'23.4R2-S5-EVO'},
  {'min_ver':'24.2-EVO', 'fixed_ver':'24.2R2-S1-EVO'},
  {'min_ver':'24.4-EVO', 'fixed_ver':'24.4R1-S2-EVO', 'fixed_display':'24.4R1-S2-EVO, 24.4R2-EVO'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_HOLE, port:0, extra:report);