Junos OS: FTP server lets a configured 'ftp' or 'anonymous' user log in without the password

CVSS 6.9CVE-2025-59980Firmware, BMC & network fabriccurated

Impact

When the FTP server is enabled on a Junos device and an account named 'ftp' or 'anonymous' exists, that account can be used without supplying the configured password, giving an unauthenticated network attacker read and write access to its home directory on the device. Write access to a file store on a switch or router is a foothold for staging content and for reading whatever has been left there - configuration snapshots, scripts, upgrade images. Datacenter network gear is shared across every tenant whose traffic crosses it, and these devices are rarely redundant enough to take out of service casually, so the practical answer is usually a configuration change rather than an immediate upgrade.

Who can reach it

Anyone who can reach the device's FTP service over the network, if the FTP server is enabled and an 'ftp' or 'anonymous' user is configured. No valid password needed.

What to do

Immediate mitigation is configuration-only and does not require a reload: disable the FTP server, or remove any user named 'ftp' or 'anonymous', and restrict management-plane reachability. The fix is Junos OS 22.4R3-S8, 23.2R2-S3 or 23.4R2 and later per JSA103167; installing it reboots the device, so schedule it with the normal network maintenance window.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59980 https://supportportal.juniper.net/JSA103167

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.