CVE-2025-30660

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).When processing a high rate of specific GRE traffic destined to the device, the respective PFE will hang causing traffic forwarding to stop.

When this issue occurs the following logs can be observed:

<fpc #> MQSS(0): LI-3: Received a parcel with more than 512B accompanying data CHASSISD_FPC_ASIC_ERROR: ASIC Error detected <...>

This issue affects Junos OS:

* all versions before 21.2R3-S9, * 21.4 versions before 21.4R3-S8, * 22.2 versions before 22.2R3-S4, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S2, * 23.4 versions before 23.4R2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

VendorProductVersions
Juniper NetworksJunos OS< 21.2R3-S9; >= 21.4, < 21.4R3-S8; >= 22.2, < 22.2R3-S4; >= 22.4, < 22.4R3-S5; >= 23.2, < 23.2R2-S2; >= 23.4, < 23.4R2

References

Timeline

Published
Apr 9, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-306617.3An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a CVE-2025-306626.5Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in CVE-2025-306637.0Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege vCVE-2025-306648.2Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2025-306656.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306666.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306676.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306686.5Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.CVE-2025-306696.5Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacenCVE-2025-30678.8Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a useCVE-2025-306706.5Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306716.5Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network
CVE-2025-30660: High severity, CVSS 7.5 | Vulnix