CVE-2026-101967 in Junos OS Evolved
Summary
by MITRE • 10/14/2026
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical security flaw within the bootzd service, which is responsible for handling zero-touch provisioning (ZTP) processes in Juniper Networks Junos OS Evolved environments. This daemon operates with elevated privileges and interacts directly with network infrastructure to configure devices automatically upon first connection or after factory resets. The core technical issue stems from insufficient input validation when processing Dynamic Host Configuration Protocol responses received via the management LAN interface. Specifically, the application fails to properly sanitize data extracted from DHCP options before passing them to underlying operating system commands for execution. This architectural oversight creates a direct pathway for OS command injection, allowing malicious actors to inject arbitrary shell commands into the provisioning workflow.
An unauthenticated attacker positioned on the same local area network segment as the management interface can exploit this weakness by crafting and transmitting specially designed DHCP response packets. By manipulating specific fields within these packets, such as option values that are subsequently used in system calls or script executions, the attacker gains the ability to execute commands with root-level privileges. This level of access is particularly dangerous because it bypasses all authentication mechanisms inherent to the Junos OS Evolved operating system. The vulnerability effectively neutralizes network perimeter defenses for devices relying on ZTP features, as no valid credentials are required to trigger the exploit condition during the initial boot or re-provisioning phase.
The operational impact of this vulnerability is severe and multifaceted. Once an attacker achieves root access through command injection, they can compromise the integrity, confidentiality, and availability of the network infrastructure. Potential consequences include the installation of persistent backdoors, modification of system configurations to facilitate further lateral movement, exfiltration of sensitive data stored on the device, or complete denial of service by disrupting critical networking services. In enterprise environments where Junos OS Evolved is deployed for automated scaling and deployment, this vulnerability could allow an attacker to compromise multiple devices simultaneously if they are configured to accept ZTP configurations from untrusted sources. The ability to execute commands as root means that standard security controls like file permissions or user isolation cannot prevent the exploitation of this flaw once the initial DHCP packet is processed.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Juniper Networks has released software updates that address this vulnerability by implementing stricter input validation within the bootzd daemon to ensure that only expected and safe values are passed to system commands. Organizations running affected versions of Junos OS Evolved should apply these patches immediately after verifying compatibility with their specific hardware models and operational requirements. In addition to patching, network segmentation is a critical defensive measure. The management LAN interface used for ZTP operations should be isolated from general user traffic and restricted to trusted subnets where only authorized DHCP servers reside. Implementing static IP assignments or disabling the zero-touch provisioning feature entirely on devices that do not require it can further reduce the attack surface by eliminating the code path exploited by this vulnerability.
From a classification perspective, this flaw aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is associated with MITRE ATT&CK technique T1059 Command and Scripting Interpreter within the Execution tactic. The attack vector leverages network-based interaction to achieve privilege escalation without authentication, highlighting the risks inherent in automated provisioning protocols that interact directly with the operating system shell. Security teams should monitor for anomalous DHCP traffic patterns on management interfaces as an indicator of potential exploitation attempts while ensuring all infrastructure components are updated to mitigate this high-severity risk.