CVE-2025-30646 Junos OS and Junos OS Evolved: Receipt of a malformed LLDP TLV results in l2cpd crash
An unauthenticated adjacent attacker can cause a denial of service by sending a malformed LLDP TLV when telemetry is active.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30646?
CVE-2025-30646 is a high-severity vulnerability in Juniper Junos, published on 9 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Signed to Unsigned Conversion Error vulnerability in the Layer 2 Control Protocol daemon (l2cpd) of Juniper Networks Junos OS and Juniper Networks Junos OS Evolved allows an unauthenticated adjacent attacker sending a specifically malformed LLDP TLV to cause the l2cpd process to crash and restart, causing a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.
When an LLDP telemetry subscription is active, receipt of a specifically malformed LLDP TLV causes the l2cpd process to crash and restart.
This issue affects:
Junos OS:
* All versions before 21.2R3-S9, * from 21.4 before 21.4R3-S10, * from 22.2 before 22.2R3-S6, * from 22.4 before 22.4R3-S6, * from 23.2 before 23.2R2-S3, * from 23.4 before 23.4R2-S4, * from 24.2 before 24.2R2;
Junos OS Evolved:
* All versions before 21.4R3-S10-EVO, * from 22.2-EVO before 22.2R3-S6-EVO, * from 22.4-EVO before 22.4R3-S6-EVO, * from 23.2-EVO before 23.2R2-S3-EVO, * from 23.4-EVO before 23.4R2-S4-EVO, * from 24.2-EVO before 24.2R2-EVO.
Weakness: CWE-195
Which versions are affected by CVE-2025-30646?
It affects 2 products.
Products include Juniper Junos, Juniper Junos Os Evolved.
How do I fix CVE-2025-30646?
No fix has been published for CVE-2025-30646 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-30646 being exploited?
There is no known exploitation of CVE-2025-30646 in the wild and no public exploit code.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-c84c-ph5v-qwvg.