CVE-2025-59961

Summary

An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the resource.

This vulnerability allows any low-privileged user logged into the system to connect to the Unix socket and issue commands to manage the DHCP service, in essence, taking administrative control of the local DHCP server or DHCP relay.

This issue affects: Junos OS:

  • all versions before 21.2R3-S10,
  • all versions of 22.2,
  • from 21.4 before 21.4R3-S12,
  • from 22.4 before 22.4R3-S8,
  • from 23.2 before 23.2R2-S5,
  • from 23.4 before 23.4R2-S6,
  • from 24.2 before 24.2R2-S2,
  • from 24.4 before 24.4R2,
  • from 25.2 before 25.2R1-S1, 25.2R2;

Junos OS Evolved:

  • all versions before 22.4R3-S8-EVO,
  • from 23.2 before 23.2R2-S5-EVO,
  • from 23.4 before 23.4R2-S6-EVO,
  • from 24.2 before 24.2R2-S2-EVO,
  • from 24.4 before 24.4R2-EVO,
  • from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OS0 < 21.2R3-S10affected
Juniper NetworksJunos OS21.4 < 21.4R3-S12affected
Juniper NetworksJunos OS22.2 < 22.2*affected
Juniper NetworksJunos OS22.4 < 22.4R3-S8affected
Juniper NetworksJunos OS23.2 < 23.2R2-S5affected
Juniper NetworksJunos OS23.4 < 23.4R2-S6affected
Juniper NetworksJunos OS24.2 < 24.2R2-S2affected
Juniper NetworksJunos OS24.4 < 24.4R2affected
Juniper NetworksJunos OS25.2 < 25.2R1-S1, 25.2R2affected
Juniper NetworksJunos OS Evolved0 < 22.4R3-S8-EVOaffected
Juniper NetworksJunos OS Evolved23.2 < 23.2R2-S5-EVOaffected
Juniper NetworksJunos OS Evolved23.4 < 23.4R2-S6-EVOaffected
Juniper NetworksJunos OS Evolved24.2 < 24.2R2-S2-EVOaffected
Juniper NetworksJunos OS Evolved24.4 < 24.4R2-EVOaffected
Juniper NetworksJunos OS Evolved25.2 < 25.2R1-S1-EVO, 25.2R2-EVOaffected

Weaknesses

  • CWE-732: CWE-732 Incorrect Permission Assignment for Critical Resource

Workarounds

Manually change permissions of the Unix socket used to control the jdhcpd server to only allow root access. For example:

root@junos> file change-permission filename /mfs/var/run/jdhcpd_mgmt permission 4700

Note: This change will not be persistent across reboots.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References