CVE-2026-101978 in Junos OS Evolved
Summary
by MITRE • 10/14/2026
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical security flaw within the bootzd service, which is responsible for zero-touch provisioning in Juniper Networks Junos OS Evolved environments deployed on PTX Series routers. This daemon facilitates the automated configuration and deployment of network devices by accepting remote commands over gRPC protocols. The core technical deficiency lies in the insufficient validation and sanitization of input data received through crafted gRPC responses. Specifically, the application fails to properly neutralize special elements within user-supplied input before incorporating them into OS-level command strings that are subsequently executed with root privileges. This lack of rigorous input filtering allows an attacker to inject arbitrary operating system commands directly into the execution context of the bootzd process.
From a technical perspective, this flaw is classified as CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The vulnerability exploits the trust relationship inherent in zero-touch provisioning workflows where management interfaces are often configured to accept connections from trusted networks without strict authentication requirements for certain initial setup phases. An unauthenticated attacker positioned on the same management LAN segment can exploit this by sending a specially crafted gRPC payload that bypasses existing validation checks. Upon processing, the bootzd daemon interprets these injected elements as legitimate system commands rather than data, leading to their execution under the highest level of privilege available within the operating system environment.
The operational impact of this vulnerability is severe due to the elevated privileges associated with the affected process. Successful exploitation grants an unauthenticated remote attacker full control over the underlying host operating system. This capability enables a wide range of malicious activities including, but not limited to, complete compromise of network infrastructure integrity, unauthorized access to sensitive configuration data, installation of persistent backdoors for long-term persistence, and lateral movement across the internal network. Attackers can also use this foothold to disrupt critical routing functions or exfiltrate confidential information stored on the device. The ability to execute commands as root effectively neutralizes most other security controls within the Junos OS Evolved environment, rendering the targeted PTX Series router fully compromised.
This attack vector aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically Remote Services such as gRPC or SSH where initial access is gained without prior authentication credentials. The scenario highlights risks associated with management plane exposure in enterprise networks where zero-touch provisioning features are enabled but not adequately secured against untrusted network segments. To mitigate this risk, organizations should immediately apply the vendor-provided software patches that address the input validation flaws within the bootzd daemon. Additionally, administrators must enforce strict access control policies on management interfaces by restricting gRPC service availability to only authorized IP addresses using firewall rules or ACLs. Disabling zero-touch provisioning features when not actively in use further reduces the attack surface. Regular auditing of network segmentation ensures that management networks remain isolated from general user traffic and untrusted zones, thereby preventing unauthorized entities from reaching vulnerable services even if authentication mechanisms are bypassed during initial setup phases.