Juniper Junos OS up to 23.1R0/23.2R2-S2/23.4R2-S2/24.2R1 jdhcpd Daemon buffer access with incorrect length value

Summaryinfo

A vulnerability marked as critical has been reported in Juniper Junos OS up to 23.1R0/23.2R2-S2/23.4R2-S2/24.2R1. Impacted is an unknown function of the component jdhcpd Daemon. Performing a manipulation results in buffer access with incorrect length value. This vulnerability is reported as CVE-2025-21591. The attacker must have access to the local network to execute the attack. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 23.1R0/23.2R2-S2/23.4R2-S2/24.2R1. It has been classified as critical. This affects an unknown code of the component jdhcpd Daemon. The manipulation with an unknown input leads to a buffer access with incorrect length value vulnerability. CWE is classifying the issue as CWE-805. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer. This is going to have an impact on availability. The summary by CVE is:

A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition. Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition. This issue affects Junos OS: * from 23.1 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R2. This issue isn't applicable to any versions of Junos OS before 23.1R1. This issue doesn't affect vSRX Series which doesn't support DHCP Snooping. This issue doesn't affect Junos OS Evolved. There are no indicators of compromise for this issue.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2025-21591 since 12/26/2024. The exploitability is told to be easy. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/26/2026).

Upgrading to version 23.1R1, 23.2R2-S3, 23.4R2-S3 or 24.2R2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 23.1R0
• 23.2R2-S2
• 23.4R2-S2
• 24.2R1

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion