CVE-2025-30651: Juniper Junos DoS Vulnerability

CVE-2025-30651 Overview

CVE-2025-30651 is a Buffer Access with Incorrect Length Value vulnerability [CWE-805] in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can send a crafted ICMPv6 packet to an interface configured with protocols router-advertisement, causing rpd to crash and restart. Continued delivery of the malicious packet sustains a Denial of Service (DoS) condition on the affected device. The issue only affects systems configured with IPv6.

Critical Impact

Remote, unauthenticated attackers can sustain a routing daemon crash loop on Juniper routers running IPv6 router advertisements, disrupting routing operations across affected production networks.

Affected Products

• Juniper Networks Junos OS (versions before 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S4, 23.2R2-S2, 23.4R2)
• Juniper Networks Junos OS Evolved (versions before 21.2R3-S9-EVO, 21.4R3-S10-EVO, 22.2R3-S6-EVO, 22.4R3-S4-EVO, 23.2R2-S2-EVO, 23.4R2-EVO)
• Devices with IPv6 enabled and protocols router-advertisement configured on an interface

Discovery Timeline

• 2025-04-09 - CVE-2025-30651 published to NVD
• 2026-01-23 - Last updated in NVD database

Technical Details for CVE-2025-30651

Vulnerability Analysis

The flaw resides in the routing protocol daemon (rpd), the Junos process responsible for managing routing protocol state, including IPv6 Neighbor Discovery and Router Advertisement (RA) messaging. When rpd processes a specific ICMPv6 packet on an interface configured for router advertisement, it accesses a buffer using an incorrect length value. The mismatch between the assumed and actual buffer size triggers a crash of the daemon.

Because rpd is central to routing convergence, its repeated restart disrupts BGP, OSPF, IS-IS, and other adjacencies that depend on the daemon. Sustained delivery of the trigger packet prevents rpd from stabilizing, producing a continuous DoS condition on the targeted device.

Root Cause

The root cause is a Buffer Access with Incorrect Length Value defect [CWE-805] in the ICMPv6 packet handling path inside rpd. The parser uses a length field that does not match the actual size of the available buffer, leading to invalid memory access and a process abort. The fault is reachable only when the interface is configured with protocols router-advertisement.

Attack Vector

Exploitation is performed over the network with no authentication and no user interaction. An attacker on an adjacent IPv6 segment, or any path that can deliver ICMPv6 traffic to an RA-enabled interface, can transmit the crafted packet. The attack does not yield code execution or data disclosure; impact is confined to availability of the routing control plane. The EPSS score is 0.403% with a percentile of 60.93, reflecting moderate predicted exploitation likelihood for a network-reachable DoS issue.

No verified exploitation code or proof-of-concept has been published. See the Juniper Security Advisory JSA96461 for vendor technical details.

Detection Methods for CVE-2025-30651

Indicators of Compromise

• Repeated rpd process crashes and restart events in Junos system logs, typically accompanied by core files generated under /var/crash/ or /var/tmp/.
• Routing protocol adjacency flaps (BGP, OSPF, IS-IS) correlated in time with rpd restarts on IPv6-enabled devices.
• Unexpected bursts of inbound ICMPv6 traffic to interfaces configured with protocols router-advertisement.

Detection Strategies

• Monitor messages and chassisd logs for entries such as rpd[<pid>]: terminated or RPD_TASK_BEGIN cycles indicating repeated daemon restarts.
• Alert on generation of rpd core files, which signal an abnormal termination consistent with the buffer access defect.
• Inspect ICMPv6 telemetry on RA-enabled interfaces for malformed Router Advertisement, Router Solicitation, or Neighbor Discovery packets that deviate from RFC 4861 expectations.

Monitoring Recommendations

• Forward Junos syslog and SNMP traps to a centralized logging or SIEM platform and create correlation rules for rpd termination events.
• Baseline normal ICMPv6 volumes per interface and alert on sustained deviations toward RA-enabled segments.
• Track routing adjacency state changes per device to identify control-plane instability that correlates with the daemon crash signature.

How to Mitigate CVE-2025-30651

Immediate Actions Required

• Identify all Junos OS and Junos OS Evolved devices with IPv6 enabled and protocols router-advertisement configured on any interface.
• Schedule upgrades to a fixed release: 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S4, 23.2R2-S2, 23.4R2, or later, including the corresponding -EVO builds for Junos OS Evolved.
• Restrict ICMPv6 traffic on untrusted interfaces using firewall filters until patches are applied.

Patch Information

Juniper has released fixed software in the Juniper Security Advisory JSA96461. Upgrade to one of the following or later: Junos OS 21.2R3-S9, 21.4R3-S10, 22.2R3-S6, 22.4R3-S4, 23.2R2-S2, 23.4R2; Junos OS Evolved 21.2R3-S9-EVO, 21.4R3-S10-EVO, 22.2R3-S6-EVO, 22.4R3-S4-EVO, 23.2R2-S2-EVO, 23.4R2-EVO.

Workarounds

• Apply a loopback or interface firewall filter to drop unexpected ICMPv6 traffic from untrusted sources while preserving legitimate Neighbor Discovery operation.
• Where IPv6 router advertisement is not required, remove protocols router-advertisement from affected interfaces to eliminate the attack surface.
• Limit IPv6 segment exposure by restricting which neighbors can reach RA-enabled interfaces through segmentation and access control.

# Example Junos firewall filter to rate-limit ICMPv6 toward the RE
set firewall family inet6 filter PROTECT-RE term LIMIT-ICMP6 from next-header icmpv6
set firewall family inet6 filter PROTECT-RE term LIMIT-ICMP6 then policer ICMP6-POLICER
set firewall family inet6 filter PROTECT-RE term LIMIT-ICMP6 then accept
set firewall policer ICMP6-POLICER if-exceeding bandwidth-limit 1m burst-size-limit 15k
set firewall policer ICMP6-POLICER then discard
set interfaces lo0 unit 0 family inet6 filter input PROTECT-RE