An integer underflow in the DHCP message decoder enables an attacker to send a crafted DHCP reply that may expose internal data before the device crashes. The flaw allows an attacker with local network access to disclose sensitive information and disrupt DHCP services, resulting in a denial of service for network devices that rely on the affected router. This weakness is categorized as CWE‑191, Integer Underflow.

Juniper Networks Session Smart Router runs in the affected state on any version prior to the following releases: 7.0.5 or newer resolves the issue for that version baseline, 7.1.7 or newer for the 7.1.x line, and 7.2.3 or newer for the 7.2.x line. Devices still in earlier releases are vulnerable.

The CVSS score is 7.1, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must have local network access and control a malicious DHCP server that can respond to DHCP solicitations. The attack path therefore requires proximity to the network and the ability to flood the router with crafted DHCP packets. Once triggered, the vulnerability can leak data and cause a restart of the DHCP service, leading to temporary network outages.