cbcvebase.
CVE-2022-22163
published 2022-01-19

CVE-2022-22163: An Improper Input Validation vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to…

PriorityP429medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.37%
29.0th percentile
An Improper Input Validation vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a crash of jdhcpd and thereby a Denial of Service (DoS). If a device is configured as DHCPv6 local server and persistent storage is enabled, jdhcpd will crash when receiving a specific DHCPv6 message. This issue affects: Juniper Networks Junos OS All versions prior to 15.1R7-S11; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S7; 19.2 versions prior to 19.2R1-S8, 19.2R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2; 21.2 versions prior to 21.2R2.

Affected

24 ranges
VendorProductVersion rangeFixed in
juniperjunos< 15.115.1
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos_os
juniper_networksjunos_os>= 18.4 < 18.4R3-S918.4R3-S9
juniper_networksjunos_os>= 19.1 < 19.1R2-S3, 19.1R3-S719.1R2-S3, 19.1R3-S7
juniper_networksjunos_os>= 19.2 < 19.2R1-S8, 19.2R3-S319.2R1-S8, 19.2R3-S3
juniper_networksjunos_os>= 19.4 < 19.4R3-S519.4R3-S5
juniper_networksjunos_os>= 20.1 < 20.1R3-S120.1R3-S1
juniper_networksjunos_os>= 20.2 < 20.2R3-S220.2R3-S2
juniper_networksjunos_os>= 20.3 < 20.3R3-S120.3R3-S1
juniper_networksjunos_os>= 20.4 < 20.4R320.4R3
juniper_networksjunos_os>= 21.1 < 21.1R221.1R2
juniper_networksjunos_os>= 21.2 < 21.2R221.2R2
juniper_networksjunos_os>= unspecified < 15.1R7-S1115.1R7-S11

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.9LOWAV:A/AC:M/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.