VendorsEdge, Infrastructure
Juniper Networks
Juniper Networks, now part of HPE, makes Junos OS and Junos OS Evolved routers and switches, SRX firewalls, Session Smart Routing and the former ScreenOS firewalls.
- Response trend, 6 months
- Not enough history
- Open now
- 1 exploited, not fully fixed
- Latest incident
- 11 Mar 2025
- Incidents on record
- 2
Response to exploited bugs
Not rated. 1 reviewed zero-day on record. A grade needs at least 3.
Fixing privately reported bugs
Not rated. No private reports in the grading window.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a Dā. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. 1 reviewed zero-day in the last 36 months. A grade needs at least 3.
- First fix within a day, for its one reviewed zero-day.
- Still no fix for every supported version after 592 days, for its one reviewed zero-day.
- First advisory within a day, for its one reviewed zero-day.
- Fixing privately reported bugs: not rated. No private reports in the last 36 months.
- NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.
Response to exploited bugs: sub-scores
- Time to first advisory1 zero-day, within a day771 case, low confidence, not used for this vendor
- Time to first fix1 zero-day, within a day771 case, low confidence, not used for this vendor
- Time to fix all versions1 zero-day, still open after 592 days691 case, low confidence, not used for this vendor
- OpennessNo machine-readable advisory feed listed. 1 of 1 zero-day with a dated revision history.443 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedNo private reports in the last 36 monthsNR0 cases, not used
Response fingerprint
Median of 1 graded zero-days. Vendor statement 24h, first fix 24h, all versions ā.
Counts toward the response grade 1
- 11 Mar 2025Junos OS kernel isolation flaw used by UNC3886 to implant backdoors on Juniper routersnow
Not graded 1: n-days, unreviewed timelines and end-of-life products
- 17 Dec 2015Juniper ScreenOS unauthorized-code backdoor allowing administrative access (2015)Not graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
2 in 24 months, 0 with known ransomware use, 50% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 11 Mar 2025 | Junos OS kernel isolation flaw used by UNC3886 to implant backdoors on Juniper routersCVE-2025-21590 | 6.7 | 1d | 1d | open | Partly fixed | Counts toward grade |
| 17 Dec 2015 | Juniper ScreenOS unauthorized-code backdoor allowing administrative access (2015)CVE-2015-7755, CVE-2015-7756 | 9.8 | same day | same day | same day | Fixed | Not graded: n-day |
Private reports
None in the window
Bugs reported privately to Juniper Networks by ZDI or Project Zero.
No privately reported cases from ZDI or Project Zero in the window.
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Juniper Networks's own alerts
- XJuniper Networks on XFollow the account and turn on notifications.
- Advisory pageJuniper security bulletins via the support-portal sitemapCheck the advisory page. It has no push channel.
What we watch
- Advisory pageJuniper security bulletins via the support-portal sitemap
See sources and health for when each was last read.
Grade not rated.