CVE-2025-21591— Junos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crash
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-21591
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Junos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crash
Source: NVD (National Vulnerability Database)
Vulnerability Description
A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition. Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition. This issue affects Junos OS: * from 23.1 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R2. This issue isn't applicable to any versions of Junos OS before 23.1R1. This issue doesn't affect vSRX Series which doesn't support DHCP Snooping. This issue doesn't affect Junos OS Evolved. There are no indicators of compromise for this issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用不正确的长度值访问缓冲区
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juniper Networks Junos OS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Networks Junos OS是美国瞻博网络（Juniper Networks）公司的一套专用于该公司的硬件设备的网络操作系统。该操作系统提供了安全编程接口和Junos SDK。 Juniper Networks Junos OS 23.1R1至23.2R2-S3之前版本、23.4至23.4R2-S3之前版本和24.2至24.2R2之前版本存在安全漏洞，该漏洞源于jdhcpd守护进程缓冲区访问长度值不正确，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Junos OS | 23.1 ~ 23.2R2-S3 | - |
II. Public POCs for CVE-2025-21591
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-21591
请登录查看更多情报信息。
Same Patch Batch · Juniper Networks · 2025-04-09 · 21 CVEs total
| CVE-2025-30649 | 7.5 HIGH | Junos OS: MX240, MX480, MX960 with SPC3: An attacker sending specific packets will cause a |
| CVE-2025-21594 | 7.5 HIGH | Junos OS: MX Series: In DS-lite and NAT scenario receipt of crafted IPv6 traffic causes po |
| CVE-2025-21601 | 7.5 HIGH | Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is e |
| CVE-2025-30644 | 7.5 HIGH | Junos OS: EX2300, EX3400, EX4000 Series, QFX5k Series: Receipt of a specific DHCP packet c |
| CVE-2025-30645 | 7.5 HIGH | Junos OS: SRX Series: Transmission of specific control traffic sent out of a DS-Lite tunne |
| CVE-2025-30660 | 7.5 HIGH | Junos OS: MX Series: Decapsulation of specific GRE packets leads to PFE reset |
| CVE-2025-30651 | 7.5 HIGH | Junos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun |
| CVE-2025-30656 | 7.5 HIGH | Junos OS: MX Series, SRX Series: Processing of specific SIP INVITE messages by the SIP ALG |
| CVE-2025-30658 | 7.5 HIGH | Junos OS: SRX Series: On devices with Anti-Virus enabled, malicious server responses will |
| CVE-2025-30659 | 7.5 HIGH | Junos OS: SRX Series: A device configured for vector routing crashes when receiving malfor |
| CVE-2025-30648 | 7.4 HIGH | Junos OS and Junos OS Evolved: Receipt of a specifically malformed DHCP packet causes jdhc |
| CVE-2025-30653 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: LSP flap in a specific MPLS scenario leads to rpd crash |
| CVE-2025-30647 | 6.5 MEDIUM | Junos OS: MX Series: Subscriber login/logout activity will lead to a memory leak |
| CVE-2025-30646 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash |
| CVE-2025-21595 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: In an EVPN-VXLAN scenario specific ARP or NDP packets cause |
| CVE-2025-30652 | 5.5 MEDIUM | Junos OS and Junos OS Evolved: Executing a specific CLI command when asregex-optimized is |
| CVE-2025-30654 | 5.5 MEDIUM | Junos OS and Junos OS Evolved: A local, low privileged user can access sensitive informati |
| CVE-2025-30655 | 5.5 MEDIUM | Junos OS and Junos OS Evolved: A specific CLI command will cause an RPD crash when rib-sha |
| CVE-2025-30657 | 5.3 MEDIUM | Junos OS: Processing of a specific BGP update causes the SRRD process to crash |
| CVE-2025-21597 | 5.3 MEDIUM | Junos OS and Junos OS Evolved: When BGP rib-sharding and update-threading are configured a |
IV. Related Vulnerabilities
Same product: Junos OS
- CVE-2026-33791
Junos OS and Junos OS Evolved: Execution of crafted CLI comm - CVE-2026-33790
Junos OS: SRX Series: In a NAT64 configuration, receipt of a - CVE-2026-33787
Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specifi - CVE-2026-33785
Junos OS: MX Series: Missing Authorization for specific 'req - CVE-2026-33781
Junos OS: EX Series, QFX Series: In a VXLAN scenario when sp
Same vendor: Juniper Networks
- CVE-2026-33791
Junos OS and Junos OS Evolved: Execution of crafted CLI comm - CVE-2026-33790
Junos OS: SRX Series: In a NAT64 configuration, receipt of a - CVE-2026-33787
Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specifi - CVE-2026-33785
Junos OS: MX Series: Missing Authorization for specific 'req - CVE-2026-33784
JSI Virtual Lightweight Collector: Default password is not r
Same weakness: CWE-805
- CVE-2026-34002
Xorg: xwayland: x.org x server: information disclosure or de - CVE-2026-6245
Sssd: out-of-bounds read in the sssd - CVE-2026-20033
Cisco NX-OS Software Denial of Service Vulnerability - CVE-2026-20010
Cisco Nexus 3000 and 9000 Series Switches Link Layer Discove - CVE-2026-1837
libjxl: Out-of-bounds write in grayscale color transformatio
V. Comments for CVE-2025-21591
No comments yet