CVE-2025-59961 is an Incorrect Permission Assignment vulnerability (CWE-732) found in the Juniper DHCP daemon (jdhcpd) component of Juniper Networks Junos OS and Junos OS Evolved. The vulnerability arises because the Unix socket used to manage the jdhcpd process is assigned permissions that allow any local, low-privileged user to connect and issue management commands. This improper permission setting enables unauthorized users to gain administrative control over the DHCP service, including DHCP server or relay functionalities. Exploiting this vulnerability does not require user interaction but does require local access to the system. The vulnerability affects a broad range of Junos OS versions, including all versions before 21.2R3-S10, all 22.2 versions, and multiple subsequent releases up to 25.2R2, as well as corresponding Junos OS Evolved versions. The CVSS v3.1 base score is 5.5 (medium severity), reflecting that the attack vector is local (AV:L), requires low privileges (PR:L), has low attack complexity (AC:L), no user interaction (UI:N), and impacts integrity (I:H) but not confidentiality or availability. While no public exploits are known, the ability to fully control DHCP services locally could allow attackers to manipulate network configurations, potentially disrupting network operations or facilitating further attacks. The vulnerability is particularly critical in environments where Juniper devices are used as DHCP servers or relays in enterprise or service provider networks.

For European organizations, this vulnerability poses a significant risk to network infrastructure integrity. DHCP services are fundamental for IP address allocation and network configuration; unauthorized control could lead to malicious DHCP responses, network misconfigurations, or denial of service for legitimate clients. Attackers with local access could redirect traffic, intercept communications, or disrupt network availability indirectly by manipulating DHCP. This is especially concerning for critical infrastructure sectors such as telecommunications, finance, energy, and government agencies that rely heavily on Juniper devices for network management. The vulnerability could facilitate lateral movement within networks if exploited by insiders or attackers who have gained initial footholds. Although remote exploitation is not possible, the widespread use of Juniper devices in European data centers and enterprise networks increases the attack surface. Failure to patch could result in compromised network integrity, impacting business continuity and regulatory compliance under frameworks like GDPR and NIS Directive.

Organizations should immediately identify all Juniper devices running affected Junos OS or Junos OS Evolved versions and prioritize patching to the fixed releases specified by Juniper Networks. Since the vulnerability requires local access, restricting administrative and user access to network devices is critical. Implement strict access controls and network segmentation to limit local user privileges on network devices. Employ robust monitoring and logging of DHCP daemon activities and Unix socket access to detect anomalous behavior. Consider deploying host-based intrusion detection systems (HIDS) on network devices where feasible. Regularly audit permission settings on critical system resources to ensure they adhere to the principle of least privilege. For environments where immediate patching is not possible, disable or restrict local user access to affected systems and enforce multi-factor authentication for device access. Coordinate with Juniper support for guidance on interim mitigations and verify firmware integrity post-patching. Finally, incorporate this vulnerability into incident response plans to quickly address any exploitation attempts.