CVE-2025-21591

Estado: AnalizadaAlta (7.1)—

A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition.

Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition.

This issue affects Junos OS:

This issue isn't applicable to any versions of Junos OS before 23.1R1.

This issue doesn't affect vSRX Series which doesn't support DHCP Snooping.

Leer descripción completaMostrar menos

This issue doesn't affect Junos OS Evolved.

There are no indicators of compromise for this issue.

Detalles técnicos trazas, registros y código del informe original

  *  from 23.1 before 23.2R2-S3,
  *  from 23.4 before 23.4R2-S3,
  *  from 24.2 before 24.2R2.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.34%
Percentil entre todas las CVEs puntuadas: 25
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %

Acceso red adyacente (AV:A) sin privilegios. Envío de paquete DHCP malformado causa crash de jdhcpd (DoS). Impacto: denegación de servicio por agotamiento de recursos en daemon de red.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Filter Network Traffic Disable or Remove Feature or Program

Tecnologías afectadas (1)

Juniper — Junos

CWE

CWE-805

Referencias

https://supportportal.juniper.net/JSA96448

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-21591",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-21591",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-10T13:17:33.869610Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 7.1,
          "Automatable": "YES",
          "attackVector": "ADJACENT",
          "baseSeverity": "HIGH",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "modules": [
            "dhcp"
          ],
          "product": "Junos OS",
          "versions": [
            {
              "status": "affected",
              "version": "23.1",
              "lessThan": "23.2R2-S3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "23.4",
              "lessThan": "23.4R2-S3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "24.2",
              "lessThan": "24.2R2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "23.1R1"
            }
          ],
          "packageName": "jdhcpd",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-09T20:15:25.363",
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA96448",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "sirt@juniper.net",
      "description": [
        {
          "lang": "en",
          "value": "CWE-805"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition.\n\nContinuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition.\n\n\nThis issue affects Junos OS:\n\n\n\n  *  from 23.1 before 23.2R2-S3,\n  *  from 23.4 before 23.4R2-S3,\n  *  from 24.2 before 24.2R2.\n\n\nThis issue isn't applicable to any versions of Junos OS before 23.1R1. \n\n\n\nThis issue doesn't affect vSRX Series which doesn't support DHCP Snooping. \n\nThis issue doesn't affect Junos OS Evolved.\n\nThere are no indicators of compromise for this issue."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de acceso al búfer con valor de longitud incorrecto en el demonio jdhcpd de Juniper Networks Junos OS, cuando la vigilancia DHCP está habilitada, permite que un atacante adyacente no autenticado envíe un paquete DHCP con una opción DHCP mal formada para provocar el bloqueo de jdhcp, creando una condición de denegación de servicio (DoS). La recepción continua de estos paquetes DHCP mediante la opción DHCP mal formada creará una condición de denegación de servicio (DoS) sostenida. Este problema afecta a Junos OS: * de 23.1R1 a 23.2R2-S3, * de 23.4 a 23.4R2-S3, * de 24.2 a 24.2R2. Este problema no afecta a ninguna versión de Junos OS anterior a 23.1R1. Este problema no afecta a la serie vSRX, que no admite la vigilancia DHCP. Este problema no afecta a Junos OS Evolved. No hay indicadores de compromiso para este problema."
    }
  ],
  "lastModified": "2026-06-17T08:43:48.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.1:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0038F142-6F5E-476D-A1EC-E977FD30F155"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A78CC80-E8B1-4CDA-BB35-A61833657FA7"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B3B2FE1-C228-46BE-AC76-70C2687050AE"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1B16FF0-900F-4AEE-B670-A537139F6909"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B227E831-30FF-4BE1-B8B2-31829A5610A6"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1ADA814B-EF98-45B1-AF7A-0C89688F7CA5"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6FB32DF-D062-4FB9-8777-452978BEC7B7"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3B6C811-5C10-4486-849D-5559B592350A"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78481ABC-3620-410D-BC78-334657E0BB75"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE8A5BA3-87BD-473A-B229-2AAB2C797005"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B74AC3E-8FC9-400A-A176-4F7F21F10756"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB2D1FCE-8019-4CE1-BA45-D62F91AF7B51"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "175CCB13-76C0-44A4-A71D-41E22B92EB23"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "166BFDB3-1945-4949-BC2B-E18442FF2E4D"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5923610F-878C-48CA-8B5D-9C609E4DD4DB"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89524D6D-0B22-4952-AD8E-8072C5A05D5C"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD69A194-1B03-44EA-8092-79BD10C6F729"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8463ADB4-B8A7-4D63-97A9-232ED713A21C"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE68337F-106E-4317-A5B6-292B0159F577"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}