CVE-2021-31359

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A local privilege escalation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to cause the Juniper DHCP daemon (jdhcpd) process to crash, resulting in a Denial of Service (DoS), or execute arbitrary commands as root. Continued processing of malicious input will repeatedly crash the system and sustain the Denial of Service (DoS) condition. Systems are only vulnerable if jdhcpd is running, which can be confirmed via the 'show system processes' command. For example: root@host# run show system processes extensive | match dhcp 26537 root -16 0 97568K 13692K RUN 0 0:01 3.71% jdhcpd This issue affects: Juniper Networks Junos OS: All versions, including the following supported releases: 15.1 versions prior to 15.1R7-S10; 17.4 versions prior to 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R2-S2, 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S3-EVO; All versions of 21.1-EVO.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-269

Affected software

VendorProductVersions
Juniper NetworksJunos OS>= 15.1, < 15.1R7-S10; >= 17.4, < 17.4R3-S5; >= 18.3, < 18.3R3-S5; >= 18.4, < 18.4R3-S9; >= 19.1, < 19.1R3-S6; >= 19.2, < 19.2R1-S7, 19.2R3-S3; >= 19.3, < 19.3R2-S6, 19.3R3-S3; >= 19.4, < 19.4R3-S6; >= 20.1, < 20.1R2-S2, 20.1R3-S1; >= 20.2, < 20.2R3-S2; >= 20.3, < 20.3R3; >= 20.4, < 20.4R2-S1, 20.4R3; >= 21.1, < 21.1R1-S1, 21.1R2
Juniper NetworksJunos OS Evolved>= unspecified, < 20.4R2-S3-EVO; >= 21.1R1-EVO, < 21.1*

References

Timeline

Published
Oct 19, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-313607.1An improper privilege management vulnerability in the Juniper Networks Junos OS and Junos OS Evolved command-line interpreter (CLI) allows aCVE-2021-313615.3An Improper Check for Unusual or Exceptional Conditions vulnerability combined with Improper Handling of Exceptional Conditions in Juniper NCVE-2021-313626.5A Protection Mechanism Failure vulnerability in RPD (routing protocol daemon) of Juniper Networks Junos OS and Junos OS Evolved allows an adCVE-2021-313636.5In an MPLS P2MP environment a Loop with Unreachable Exit Condition vulnerability in the routing protocol daemon (RPD) of Juniper Networks JuCVE-2021-313645.9An Improper Check for Unusual or Exceptional Conditions vulnerability combined with a Race Condition in the flow daemon (flowd) of Juniper NCVE-2021-313656.5An Uncontrolled Resource Consumption vulnerability in Juniper Networks Junos OS on EX2300, EX3400 and EX4300 Series platforms allows an adjaCVE-2021-313666.5An Unchecked Return Value vulnerability in the authd (authentication daemon) of Juniper Networks Junos OS on MX Series configured for subscrCVE-2021-313676.5A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTXCVE-2021-313687.5An Uncontrolled Resource Consumption vulnerability in the kernel of Juniper Networks JUNOS OS allows an unauthenticated network based attackCVE-2021-313695.3On MX Series platforms with MS-MPC/MS-MIC, an Allocation of Resources Without Limits or Throttling vulnerability in Juniper Networks Junos OCVE-2021-31375.4XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.CVE-2021-313706.5An Incomplete List of Disallowed Inputs vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and E
CVE-2021-31359: High severity, CVSS 7.8 | Vulnix