CVE-2025-30644: Juniper Junos Buffer Overflow Vulnerability

CVE-2025-30644 Overview

CVE-2025-30644 is a heap-based buffer overflow [CWE-122] in the flexible PIC concentrator (FPC) component of Juniper Networks Junos OS. The flaw affects EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series switches. An adjacent-network attacker can send a specially crafted DHCP packet that triggers an FPC crash and restart, producing a Denial of Service (DoS) condition. Continued processing of the malicious packet sustains the DoS. When DHCP Option 82 is enabled, a rare timing condition can also induce memory corruption that affects packet forwarding. The heap-based nature of the overflow means exploitation could lead to remote code execution within the FPC, granting complete control of the vulnerable component.

Critical Impact
A single malformed DHCP packet can crash the FPC on core Juniper switching platforms and may enable code execution within the forwarding plane.

Affected Products

Juniper Junos OS on EX Series: EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y
Juniper Junos OS on QFX5k Series: QFX5110, QFX5120, QFX5130, QFX5200, QFX5210, QFX5220, QFX5230-64CD, QFX5240, QFX5241, QFX5700
Junos OS versions before 21.4R3-S9, 22.2 before 22.2R3-S5, 22.4 before 22.4R3-S5, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S3, and 24.2 before 24.2R2

Discovery Timeline

2025-04-09 - CVE-2025-30644 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-30644

Vulnerability Analysis

The vulnerability resides in the FPC, the line-card subsystem that performs packet forwarding on Juniper EX and QFX switches. Processing of a specific DHCP packet writes beyond the bounds of a heap-allocated buffer. The resulting corruption causes the FPC process to crash, interrupting forwarding on the affected line card. After the crash, the FPC restarts, but sustained delivery of the triggering packet keeps the device in a forwarding-impaired state.

Because the overflow occurs on the heap, the corruption is not limited to immediate process termination. An attacker who controls adjacent memory layout could overwrite control structures and influence execution flow within the FPC. Juniper documents this as a potential path to remote code execution inside the FPC component.

Root Cause

The root cause is improper bounds checking when the FPC parses fields within a DHCP packet, classified under [CWE-122] Heap-based Buffer Overflow. A secondary memory-corruption path is documented when DHCP Option 82 (Relay Agent Information) is enabled, where a timing condition outside the attacker's control can trigger the same class of corruption.

Attack Vector

The attack vector is adjacent network. The attacker must be able to deliver a DHCP packet to the device, typically requiring presence on the same broadcast domain or a DHCP relay path that forwards the packet to the vulnerable FPC. No authentication or user interaction is required. The triggering condition is a specific, malformed DHCP payload.

No public proof-of-concept code is available, and exploitation in the wild has not been reported. See the Juniper Security Advisory JSA96453 for vendor technical details.

Detection Methods for CVE-2025-30644

Indicators of Compromise

Unexplained FPC crashes or restarts on EX or QFX Series devices, particularly correlated with inbound DHCP traffic
Core files generated by the FPC process following DHCP packet reception
Repeated forwarding interruptions on a specific line card while DHCP relay or Option 82 is configured

Detection Strategies

Monitor Junos show chassis fpc and show chassis alarms output for FPC restart events and forwarding alarms
Inspect syslog for messages indicating FPC reset, core dump, or DHCP processing errors
Capture DHCP traffic at network edges and inspect for malformed option fields or oversized payloads targeting affected switches

Monitoring Recommendations

Forward Junos syslog and SNMP traps to a centralized SIEM and alert on FPC reset events
Track DHCP packet rates per ingress interface and alert on anomalous bursts toward management or relay-enabled VLANs
Correlate FPC crash events with upstream DHCP client and relay activity to identify the source of triggering packets

How to Mitigate CVE-2025-30644

Immediate Actions Required

Identify all EX and QFX Series devices running Junos OS versions listed in the advisory and prioritize them for patching
Restrict DHCP traffic at access ports using DHCP snooping, port-based filters, or firewall filters that limit DHCP to trusted relay sources
Review whether DHCP Option 82 is enabled and assess exposure to the secondary memory-corruption path

Patch Information

Juniper has released fixed software in Junos OS 21.4R3-S9, 22.2R3-S5, 22.4R3-S5, 23.2R2-S3, 23.4R2-S3, 24.2R2, and all subsequent releases. Upgrade affected EX and QFX Series devices to a fixed release as documented in Juniper Security Advisory JSA96453.

Workarounds

Apply firewall filters on the loopback and management interfaces to permit DHCP only from known relay agents and servers
Enable DHCP snooping on access VLANs to discard untrusted DHCP messages before they reach the FPC
Segment user-facing networks from device control planes to limit exposure to adjacent-network attackers

bash

# Example Junos firewall filter restricting DHCP to trusted relays
set firewall family inet filter PROTECT-DHCP term TRUSTED-RELAY from source-address 10.0.0.10/32
set firewall family inet filter PROTECT-DHCP term TRUSTED-RELAY from protocol udp
set firewall family inet filter PROTECT-DHCP term TRUSTED-RELAY from destination-port [ 67 68 ]
set firewall family inet filter PROTECT-DHCP term TRUSTED-RELAY then accept
set firewall family inet filter PROTECT-DHCP term BLOCK-OTHER-DHCP from protocol udp
set firewall family inet filter PROTECT-DHCP term BLOCK-OTHER-DHCP from destination-port [ 67 68 ]
set firewall family inet filter PROTECT-DHCP term BLOCK-OTHER-DHCP then discard