CVE-2025-59961: Junos OS jdhcpd Privilege Escalation Flaw

CVE-2025-59961 Overview

An Incorrect Permission Assignment for Critical Resource vulnerability has been identified in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved. This security flaw allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the DHCP resource.

The vulnerability is particularly concerning because it enables any low-privileged user who has logged into the system to connect to the Unix socket and issue commands to manage the DHCP service. This effectively allows an attacker to take administrative control of the local DHCP server or DHCP relay functionality, potentially disrupting network operations or enabling further attacks within the network infrastructure.

Critical Impact

Local privilege escalation allowing low-privileged users to gain complete administrative control over DHCP services through improperly secured Unix socket permissions.

Affected Products

• Junos OS: All versions before 21.2R3-S10, all versions of 22.2, from 21.4 before 21.4R3-S12, from 22.4 before 22.4R3-S8, from 23.2 before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S2, from 24.4 before 24.4R2, from 25.2 before 25.2R1-S1 or 25.2R2
• Junos OS Evolved: All versions before 22.4R3-S8-EVO, from 23.2 before 23.2R2-S5-EVO, from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-S2-EVO, from 24.4 before 24.4R2-EVO, from 25.2 before 25.2R1-S1-EVO or 25.2R2-EVO

Discovery Timeline

• 2026-01-15 - CVE CVE-2025-59961 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2025-59961

Vulnerability Analysis

This vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), which represents a fundamental access control failure in the jdhcpd process. The root issue lies in the improper permission configuration of the Unix domain socket that the DHCP daemon uses for inter-process communication and management operations.

Unix sockets are a common mechanism for local process communication in Unix-like systems, but when their permissions are not properly restricted, they can become a vector for privilege escalation attacks. In this case, the socket that manages the jdhcpd process lacks appropriate access restrictions, allowing any authenticated local user to interact with it regardless of their actual privilege level.

The local attack vector requires an attacker to first gain access to the target system with any valid user account. Once authenticated, even with minimal privileges, the attacker can interact with the misconfigured socket to send management commands to the DHCP daemon.

Root Cause

The vulnerability stems from incorrect permission assignment on the Unix socket used by the Juniper DHCP daemon (jdhcpd). When the socket is created, the file system permissions are not sufficiently restrictive, allowing read and write access to users who should not have administrative control over the DHCP service. This represents a violation of the principle of least privilege, where critical system resources should only be accessible to authorized administrative processes.

Attack Vector

The attack requires local access to the affected Juniper device with a low-privileged user account. The exploitation flow involves:

1. The attacker authenticates to the Junos OS or Junos OS Evolved system with any valid user credentials
2. The attacker locates the Unix socket used by the jdhcpd process
3. Due to improper permissions, the attacker can connect to this socket
4. Once connected, the attacker can issue management commands to the DHCP daemon
5. This grants the attacker effective administrative control over DHCP server or relay operations

The vulnerability mechanism involves the Unix socket file permissions being too permissive, allowing write access to low-privileged users. Attackers can leverage standard socket communication methods to send commands to the DHCP daemon as if they were an authorized administrator. For complete technical details, refer to the Juniper Security Advisory JSA103150.

Detection Methods for CVE-2025-59961

Indicators of Compromise

• Unexpected connections to the jdhcpd Unix socket from non-administrative user processes
• Unusual DHCP configuration changes or service restarts not initiated by authorized administrators
• Log entries showing DHCP management commands executed by low-privileged user accounts
• Anomalous DHCP lease assignments or relay configurations that deviate from established policies

Detection Strategies

• Monitor system logs for socket access patterns to the jdhcpd management socket
• Implement file integrity monitoring on the DHCP daemon socket and configuration files
• Configure audit logging for all interactions with the jdhcpd process and related Unix sockets
• Review user session logs for any interaction with DHCP management interfaces by non-administrative users

Monitoring Recommendations

• Enable comprehensive logging of DHCP service operations and configuration changes
• Deploy SentinelOne agents configured to monitor for unauthorized process interactions with system services
• Implement alerting for any non-root user attempting to access DHCP management sockets
• Regularly audit user permissions and access patterns on network infrastructure devices

How to Mitigate CVE-2025-59961

Immediate Actions Required

• Upgrade affected Junos OS systems to version 21.2R3-S10, 21.4R3-S12, 22.4R3-S8, 23.2R2-S5, 23.4R2-S6, 24.2R2-S2, 24.4R2, 25.2R1-S1, or 25.2R2 or later
• Upgrade affected Junos OS Evolved systems to version 22.4R3-S8-EVO, 23.2R2-S5-EVO, 23.4R2-S6-EVO, 24.2R2-S2-EVO, 24.4R2-EVO, 25.2R1-S1-EVO, or 25.2R2-EVO or later
• Restrict local user access to only essential personnel while patches are being deployed
• Review all local user accounts for unnecessary access privileges

Patch Information

Juniper Networks has released security patches addressing this vulnerability across multiple Junos OS and Junos OS Evolved versions. Administrators should consult the Juniper Security Advisory JSA103150 for specific patch versions and upgrade guidance. The Juniper Support Portal provides access to the latest firmware updates and detailed upgrade instructions.

Workarounds

• Restrict local shell access to only essential administrative users until patches can be applied
• Implement strict access controls limiting which users can log into the affected devices locally
• Monitor and audit all local user activity on affected systems for suspicious behavior
• Consider network segmentation to limit access to management interfaces of affected devices

# Example: Restrict local user access on Junos OS
# Review and limit user accounts with shell access
show system users

# Configure class-based restrictions for non-admin users
set system login class restricted-user permissions view
set system login class restricted-user deny-commands "request system"