7.4

CVE-2025-21591

Medienbericht
A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition.

Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition.


This issue affects Junos OS:



  *  from 23.1 before 23.2R2-S3,
  *  from 23.4 before 23.4R2-S3,
  *  from 24.2 before 24.2R2.


This issue isn't applicable to any versions of Junos OS before 23.1R1. 



This issue doesn't affect vSRX Series which doesn't support DHCP Snooping. 

This issue doesn't affect Junos OS Evolved.

There are no indicators of compromise for this issue.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Juniper ≫ Junos Version23.1 Updater1
Juniper ≫ Junos Version23.2 Update-
Juniper ≫ Junos Version23.2 Updater1
Juniper ≫ Junos Version23.2 Updater1-s1
Juniper ≫ Junos Version23.2 Updater1-s2
Juniper ≫ Junos Version23.2 Updater2
Juniper ≫ Junos Version23.2 Updater2-s1
Juniper ≫ Junos Version23.2 Updater2-s2
Juniper ≫ Junos Version23.4 Update-
Juniper ≫ Junos Version23.4 Updater1
Juniper ≫ Junos Version23.4 Updater1-s1
Juniper ≫ Junos Version23.4 Updater1-s2
Juniper ≫ Junos Version23.4 Updater2
Juniper ≫ Junos Version23.4 Updater2-s1
Juniper ≫ Junos Version23.4 Updater2-s2
Juniper ≫ Junos Version24.2 Update-
Juniper ≫ Junos Version24.2 Updater1
Juniper ≫ Junos Version24.2 Updater1-s1
Juniper ≫ Junos Version24.2 Updater1-s2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.332
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
sirt@juniper.net 7.1 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green
sirt@juniper.net 7.4 2.8 4
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-805 Buffer Access with Incorrect Length Value

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.