Product:
Junos OS
Summary
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Juniper DHCP service allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service on the downstream DHCP server. The DHCP relay forwards packets unmodified, which uses up addresses in the DHCP server’s address pool, ultimately leading to address pool exhaustion. This issue affects multiple versions of Junos OS and Junos OS Evolved.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.3 | CVE-2025-59960 |
Exploitation
To exploit this vulnerability, an attacker can send a specific DHCP DISCOVER message in ‘forward-only’ mode with Option 82 to the DHCP relay. If the relay is not configured to trust Option 82, it will forward the message to the DHCP server without modification. This can lead to the exhaustion of the DHCP server’s address pool, causing a Denial of Service for clients attempting to obtain an IP address.
Affected Products
- Junos OS: All versions before 21.2R3-S10, from 21.4 before 21.4R3-S12, all versions of 22.2, from 22.4 before 22.4R3-S8, from 23.2 before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S2, from 24.4 before 24.4R2, from 25.2 before 25.2R1-S1, 25.2R2.
- Junos OS Evolved: All versions before 21.4R3-S12-EVO, all versions of 22.2-EVO, from 22.4 before 22.4R3-S8-EVO, from 23.2 before 23.2R2-S5-EVO, from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-S2-EVO, from 24.4 before 24.4R2-EVO, from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
Mitigation
To mitigate this vulnerability, it is recommended to configure the DHCP relay to trust Option 82. This will prevent the relay from forwarding untrusted DHCP DISCOVER messages, thus protecting the DHCP server’s address pool from exhaustion. Additionally, updating to the latest versions of Junos OS and Junos OS Evolved that address this vulnerability is advised.