CVE-2025-21591 | Junos OS: An unauthenticated adjacent attacker sending a malformed DHCP packet causes jdhcpd to crash

A Buffer Access with Incorrect Length Value vulnerability in the jdhcpd daemon of Juniper Networks Junos OS, when DHCP snooping is enabled, allows an unauthenticated, adjacent, attacker to send a DHCP packet with a malformed DHCP option to cause jdhcp to crash creating a Denial of Service (DoS) condition. Continuous receipt of these DHCP packets using the malformed DHCP Option will create a sustained Denial of Service (DoS) condition. This issue affects Junos OS: * from 23.1 before 23.2R2-S3, * from 23.4 before 23.4R2-S3, * from 24.2 before 24.2R2. This issue isn't applicable to any versions of Junos OS before 23.1R1. This issue doesn't affect vSRX Series which doesn't support DHCP Snooping. This issue doesn't affect Junos OS Evolved. There are no indicators of compromise for this issue.

Published: 2025-04-09 Last update: 2026-01-26 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2025-21591 is rated Moderate Risk (40.1/100): CVSS High severity, with low exploitation likelihood (EPSS 0.13%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2025-21591

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-02-03 0.01% 0.13% +0.12%
2 2025-04-10 — 0.01% —

Full EPSS history (2 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-21591

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.1 4.0 HIGH
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Green Click to expand
Attack vector (AV:A)
Attacker has to be on an adjacent/local network segment.
Attack complexity (AC:L)
Exploitation conditions are straightforward and stable.
Attack requirements (AT:N)
No additional preconditions are required beyond normal reachability.
Privileges required (PR:N)
No privileges are required.
User interaction (UI:N)
No user interaction is required.
Vulnerable system confidentiality impact (VC:N)
No confidentiality impact on the vulnerable system.
Vulnerable system integrity impact (VI:N)
No integrity impact on the vulnerable system.
Vulnerable system availability impact (VA:H)
High availability impact on the vulnerable system.
Subsequent system confidentiality impact (SC:N)
No confidentiality impact on subsequent systems.
Subsequent system integrity impact (SI:N)
No integrity impact on subsequent systems.
Subsequent system availability impact (SA:L)
Limited availability impact on subsequent systems.
Exploit maturity (threat) (E:X)
Not defined: no reliable threat intelligence; scoring assumes the worst case (equivalent to Attacked).
Confidentiality requirement (CR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Integrity requirement (IR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Availability requirement (AR:X)
Not defined: insufficient information; scoring treats this like High (worst case).
Modified attack vector (MAV:X)
Not defined: scoring uses the Base Attack Vector (AV).
Modified attack complexity (MAC:X)
Not defined: scoring uses the Base Attack Complexity (AC).
Modified attack requirements (MAT:X)
Not defined: scoring uses the Base Attack Requirements (AT).
Modified privileges required (MPR:X)
Not defined: scoring uses the Base Privileges Required (PR).
Modified user interaction (MUI:X)
Not defined: scoring uses the Base User Interaction (UI).
Modified vulnerable system confidentiality impact (MVC:X)
Not defined: scoring uses the Base VC metric.
Modified vulnerable system integrity impact (MVI:X)
Not defined: scoring uses the Base VI metric.
Modified vulnerable system availability impact (MVA:X)
Not defined: scoring uses the Base VA metric.
Modified subsequent system confidentiality impact (MSC:X)
Not defined: scoring uses the Base SC metric.
Modified subsequent system integrity impact (MSI:X)
Not defined: scoring uses the Base SI metric.
Modified subsequent system availability impact (MSA:X)
Not defined: scoring uses the Base SA metric.
Safety (supplemental) (S:X)
Not evaluated.
Automatable (supplemental) (AU:Y)
Yes: all four kill-chain steps (reconnaissance, weaponization, delivery, exploitation) can be automated.
Recovery (supplemental) (R:U)
User: manual user intervention is needed to recover services.
Value density (supplemental) (V:C)
Concentrated: a single exploit event controls rich resources (e.g., a central server).
Vulnerability response effort (supplemental) (RE:M)
Moderate effort (remote update, disable subsystem, simple upgrade with minor service impact).
Provider urgency (supplemental) (U:GREEN)
Green: provider rates reduced urgency.
 — — [email protected]
7.4 3.1 HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Click to expand
Attack vector (AV:A)
Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.8 4.0 [email protected]

Weakness enumeration for CVE-2025-21591

Affected software / configurations for CVE-2025-21591

Vendor Product Version Raw CPE
juniper junos 23.1 cpe:2.3:o:juniper:junos:23.1:r1:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*
juniper junos 23.2 cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*
juniper junos 23.4 cpe:2.3:o:juniper:junos:23.4:r2-s2:*:*:*:*:*:*
juniper junos 24.2 cpe:2.3:o:juniper:junos:24.2:-:*:*:*:*:*:*
juniper junos 24.2 cpe:2.3:o:juniper:junos:24.2:r1:*:*:*:*:*:*
juniper junos 24.2 cpe:2.3:o:juniper:junos:24.2:r1-s1:*:*:*:*:*:*
juniper junos 24.2 cpe:2.3:o:juniper:junos:24.2:r1-s2:*:*:*:*:*:*

References for CVE-2025-21591

cvelogic Threat Intelligence