CVE-2025-30648

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.1HIGH

EPSS

0.1%

top 67.28%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Juniper Networks Junos OS Juniper Networks Junos OS Evolved Juniper Junos +1 more

Timeline

PublishedApr 9

Description

An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause the jdhcpd process to crash resulting in a Denial of Service (DoS). When a specifically malformed DHCP packet is received from a DHCP client, the jdhcpd process crashes, which will lead to the unavailability of the DHCP service and thereby resulting in a sustained DoS. The DHCP process will restart automatically to…

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os_evolved22.4 — 22.4R3-S6-EVO+3

▶NVDjuniper/junos_os_evolved4 versions+3

▶CVEListV5juniper_networks/junos_os21.4 — 21.4R3-S10+6

▶NVDjuniper/junos< 21.2+7

🔴Vulnerability Details

CVEList

Junos OS and Junos OS Evolved: Receipt of a specifically malformed DHCP packet causes jdhcpd process to crash↗2025-04-09

▶

GHSA

GHSA-fx3j-rg5r-vrx4: An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthentic↗2025-04-09

▶

📋Vendor Advisories

Juniper

CVE-2025-30648: An Improper Input Validation vulnerability in the Juniper DHCP Daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthentic↗2025-04-09

▶