Juniper Junos OS up to 24.2R1 Flexible PIC Concentrator heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in Juniper Junos OS up to 24.2R1. Affected is an unknown function of the component Flexible PIC Concentrator. The manipulation leads to heap-based overflow. This vulnerability is traded as CVE-2025-30644. Access to the local network is required for this attack to succeed. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 24.2R1 and classified as critical. This issue affects an unknown code of the component Flexible PIC Concentrator. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A Heap-based Buffer Overflow vulnerability in the flexible PIC concentrator (FPC) of Juniper Networks Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series allows an attacker to send a specific DHCP packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Under a rare timing scenario outside the attacker's control, memory corruption may be observed when DHCP Option 82 is enabled, leading to an FPC crash and affecting packet forwarding. Due to the nature of the heap-based overflow, exploitation of this vulnerability could also lead to remote code execution within the FPC, resulting in complete control of the vulnerable component. This issue affects Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series: * All versions before 21.4R3-S9,  * from 22.2 before 22.2R3-S5,  * from 22.4 before 22.4R3-S5,  * from 23.2 before 23.2R2-S3,  * from 23.4 before 23.4R2-S3,  * from 24.2 before 24.2R2.

It is possible to read the advisory at supportportal.juniper.net. The identification of this vulnerability is CVE-2025-30644 since 03/24/2025. The exploitation is known to be easy. The attack needs to be initiated within the local network. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/29/2026).

The vulnerability scanner Nessus provides a plugin with the ID 310769 (Juniper Junos OS Vulnerability (JSA96453)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 21.4R3-S9, 22.2R3-S5, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3 or 24.2R2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (310769). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 21.4R3-S8
• 22.2R3-S4
• 22.4R3-S4
• 23.2R2-S2
• 23.4R2-S2
• 24.2R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion