CVE-2025-59960: Junos OS DHCP Service DoS Vulnerability

CVE-2025-59960 Overview

CVE-2025-59960 is an Improper Check for Unusual or Exceptional Conditions vulnerability (CWE-754) affecting the Juniper DHCP service (jdhcpd) in Juniper Networks Junos OS and Junos OS Evolved. This flaw allows a DHCP client positioned in one subnet to exhaust the address pools of other subnets, resulting in a Denial of Service (DoS) condition on downstream DHCP servers.

The vulnerability stems from improper handling of DHCP Option 82 information in 'forward-only' mode. By default, the DHCP relay agent inserts its own Option 82 information when forwarding client requests, optionally replacing any Option 82 information provided by the client. When a specific DHCP DISCOVER packet is received in 'forward-only' mode with Option 82, the device should drop the message unless trust-option82 is configured. Instead, the DHCP relay improperly forwards these packets to the DHCP server unmodified, consuming addresses from the server's address pool and ultimately leading to pool exhaustion.

Critical Impact

An attacker on an adjacent network can exhaust DHCP address pools across multiple subnets, denying legitimate clients the ability to obtain IP addresses and disrupting network connectivity for affected segments.

Affected Products

• Juniper Networks Junos OS: all versions before 21.2R3-S10, from 21.4 before 21.4R3-S12, all versions of 22.2, from 22.4 before 22.4R3-S8, from 23.2 before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S2, from 24.4 before 24.4R2, from 25.2 before 25.2R1-S1 / 25.2R2
• Juniper Networks Junos OS Evolved: all versions before 21.4R3-S12-EVO, all versions of 22.2-EVO, from 22.4 before 22.4R3-S8-EVO, from 23.2 before 23.2R2-S5-EVO, from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-S2-EVO, from 24.4 before 24.4R2-EVO, from 25.2 before 25.2R1-S1-EVO / 25.2R2-EVO

Discovery Timeline

• 2026-01-15 - CVE-2025-59960 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-59960

Vulnerability Analysis

This vulnerability represents a classic case of improper input validation in network protocol handling. The Juniper DHCP service (jdhcpd) fails to properly validate and reject DHCP DISCOVER packets containing client-supplied Option 82 information when operating in 'forward-only' mode without the trust-option82 configuration option enabled.

DHCP Option 82, also known as the DHCP Relay Agent Information option, is typically used by relay agents to insert circuit identification and remote identification information into DHCP requests. This information helps DHCP servers make intelligent address allocation decisions based on the client's physical location in the network topology.

The security model assumes that in 'forward-only' mode, packets with pre-existing Option 82 data should be discarded unless explicitly trusted. The vulnerability breaks this assumption, allowing malicious clients to craft DHCP DISCOVER packets with manipulated Option 82 information that causes the DHCP server to allocate addresses from unintended pools.

Root Cause

The root cause is an Improper Check for Unusual or Exceptional Conditions (CWE-754) in the jdhcpd service. The code path responsible for processing DHCP DISCOVER packets in 'forward-only' mode does not properly validate whether incoming packets already contain Option 82 information before forwarding them to the upstream DHCP server.

When the DHCP relay receives a DISCOVER packet with Option 82 already present, it should check the trust-option82 configuration. If this option is not enabled, the packet should be dropped. The flawed implementation bypasses this validation check, forwarding the packet with the attacker-controlled Option 82 information intact.

Attack Vector

The attack requires adjacent network access, meaning an attacker must be positioned on the same network segment or have the ability to send DHCP traffic to the vulnerable relay agent. The attack sequence involves:

1. The attacker crafts DHCP DISCOVER packets containing fabricated Option 82 information that references address pools from different subnets
2. These malicious packets are sent to the vulnerable Juniper device acting as a DHCP relay in 'forward-only' mode
3. The relay improperly forwards these packets to the downstream DHCP server without stripping or validating the Option 82 information
4. The DHCP server processes these requests and allocates addresses from the pools indicated by the spoofed Option 82 data
5. Repeated exploitation exhausts address pools across multiple subnets, denying service to legitimate clients

The vulnerability is exploitable by sending specially crafted DHCP DISCOVER packets with manipulated Option 82 (Relay Agent Information) fields to a vulnerable Juniper DHCP relay operating in 'forward-only' mode. The relay fails to validate and drop these packets when trust-option82 is not configured, instead forwarding them unmodified to the DHCP server. This allows an attacker to influence address allocation from pools in different subnets, ultimately exhausting available addresses. For detailed technical information, refer to the Juniper Security Advisory JSA103149.

Detection Methods for CVE-2025-59960

Indicators of Compromise

• Unexpected DHCP DISCOVER packets containing Option 82 information from client segments
• Rapid depletion of DHCP address pools across multiple subnets without corresponding legitimate client activity
• DHCP server logs showing address allocations to pools that don't match the originating relay agent's expected subnet
• Increased DHCP NAK responses due to pool exhaustion

Detection Strategies

• Monitor DHCP relay statistics for anomalous forwarding patterns, particularly DISCOVER packets with pre-existing Option 82 data
• Implement DHCP server monitoring to detect rapid address pool consumption across multiple scopes
• Configure network monitoring to alert on DHCP traffic volumes exceeding normal baselines
• Review jdhcpd logs for unusual Option 82 processing behavior

Monitoring Recommendations

• Enable detailed DHCP logging on Juniper devices to capture Option 82 handling events
• Deploy network traffic analysis tools to monitor DHCP protocol behavior at relay points
• Establish baseline metrics for DHCP pool utilization and alert on deviations
• Consider implementing DHCP snooping on access switches to validate DHCP traffic

How to Mitigate CVE-2025-59960

Immediate Actions Required

• Identify all Juniper Junos OS and Junos OS Evolved devices operating as DHCP relays in 'forward-only' mode
• Review current software versions against the affected version list and prioritize patching
• Consider enabling trust-option82 only where explicitly required and understood
• Implement network segmentation to limit attacker access to DHCP relay interfaces

Patch Information

Juniper Networks has released patched versions addressing this vulnerability. Organizations should upgrade to the following minimum versions:

Junos OS:

• 21.2R3-S10 or later (for versions before 21.4)
• 21.4R3-S12 or later
• 22.4R3-S8 or later
• 23.2R2-S5 or later
• 23.4R2-S6 or later
• 24.2R2-S2 or later
• 24.4R2 or later
• 25.2R1-S1 or 25.2R2 or later

Junos OS Evolved:

• 21.4R3-S12-EVO or later
• 22.4R3-S8-EVO or later
• 23.2R2-S5-EVO or later
• 23.4R2-S6-EVO or later
• 24.2R2-S2-EVO or later
• 24.4R2-EVO or later
• 25.2R1-S1-EVO or 25.2R2-EVO or later

Note: Version 22.2 and 22.2-EVO are listed as entirely affected; organizations running these versions should migrate to a supported release. Refer to the Juniper Security Advisory JSA103149 for complete patch details.

Workarounds

• If forward-only mode is not strictly required, consider alternative DHCP relay configurations
• Implement access control lists (ACLs) to restrict DHCP traffic to known legitimate sources
• Deploy rate limiting on DHCP relay interfaces to slow potential exploitation attempts
• Consider implementing DHCP server-side controls to limit allocations per relay circuit

# Example: Check current DHCP relay configuration
show configuration forwarding-options dhcp-relay

# Example: Verify DHCP relay statistics for anomalies
show dhcp relay statistics

# Example: Review jdhcpd process status
show system processes extensive | match jdhcpd