CVE-2025-30644

A Heap-based Buffer Overflow vulnerability in the flexible PIC concentrator (FPC) of Juniper Networks Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series allows an attacker to send a specific DHCP packet to the device, leading to an FPC crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. Under a rare timing scenario outside the attacker's control, memory corruption may be observed when DHCP Option 82 is enabled, leading to an FPC crash and affecting packet forwarding. Due to the nature of the heap-based overflow, exploitation of this vulnerability could also lead to remote code execution within the FPC, resulting in complete control of the vulnerable component. This issue affects Junos OS on EX2300, EX3400, EX4100, EX4300, EX4300MP, EX4400, EX4600, EX4650-48Y, and QFX5k Series: * All versions before 21.4R3-S9,  * from 22.2 before 22.2R3-S5,  * from 22.4 before 22.4R3-S5,  * from 23.2 before 23.2R2-S3,  * from 23.4 before 23.4R2-S3,  * from 24.2 before 24.2R2.

• CWE-122

• https://supportportal.juniper.net/JSA96453Vendor Advisory

Published

Apr 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30638Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-30639Missing Authorization vulnerability in ThemeAtelier IDonateP…7.5
• CVE-2025-3064The WPFront User Role Editor plugin for WordPress is vulnera…8.8
• CVE-2025-30640A link following vulnerability in Trend Micro Deep Security …7.8
• CVE-2025-30641A link following vulnerability in the anti-malware solution …7.8
• CVE-2025-30642A link following vulnerability in Trend Micro Deep Security …5.5
• CVE-2025-30645A NULL Pointer Dereference vulnerability in the flow daemon …8.7
• CVE-2025-30646A Signed to Unsigned Conversion Error vulnerability in the L…7.1
• CVE-2025-30647A Missing Release of Memory after Effective Lifetime vulnera…7.1
• CVE-2025-30648An Improper Input Validation vulnerability in the Juniper DH…7.4
• CVE-2025-30649An Improper Input Validation vulnerability in the syslog str…8.7
• CVE-2025-3065The Database Toolset plugin is vulnerable to arbitrary file …9.1