CVE-2026-102047 in Junos OS
Summary
by MITRE • 10/14/2026
An Improper Validation of Consistency within Input vulnerability in the l2cpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated Layer 2 attacker to cause a denial of service in associated Layer 2 control protocols via a crafted MVRP Ethernet frame sent to an MVRP-enabled interface.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as Improper Validation of Consistency within Input represents a critical flaw in the Link Aggregation Control Protocol daemon, specifically l2cpd, which is responsible for managing Layer 2 control protocols on Juniper Networks devices running Junos OS and Junos OS Evolved. This defect arises from insufficient validation mechanisms when processing incoming Management VLAN Registration Protocol MVRP frames. An attacker positioned at an adjacent network segment can exploit this weakness by transmitting specially crafted Ethernet frames that contain inconsistent or malformed data fields within the MVRP payload. Because the l2cpd process fails to adequately verify the structural integrity and logical consistency of these inputs, it enters a state of operational instability rather than gracefully rejecting the invalid packets as expected in standard protocol implementations.
From an operational perspective, this lack of input sanitization leads directly to a denial of service condition affecting associated Layer 2 control protocols on the affected device. When the daemon processes the crafted MVRP frame, the internal inconsistency triggers a crash or hang within the l2cpd process. Since this daemon is integral to maintaining network topology awareness and port state synchronization at Layer 2, its failure disrupts critical networking functions such as VLAN propagation and link aggregation status updates. The impact extends beyond the immediate device, potentially causing broader connectivity issues for other devices relying on accurate Layer 2 control plane information from the compromised Juniper switch or router.
This vulnerability aligns with CWE-20 Improper Input Validation, specifically highlighting failures in checking data consistency during processing rather than just format validation. It also maps to MITRE ATT&CK technique T1498 Network Denial of Service, where an adversary disrupts availability by exploiting protocol implementation flaws. The attack vector is classified as adjacent unauthenticated, meaning the attacker does not need prior access credentials but must have physical or logical connectivity to the same broadcast domain or switched segment as the target interface. This proximity requirement limits the scope compared to remote network attacks but remains significant in environments where trusted and untrusted networks are segmented only at higher layers or where rogue devices can be plugged into accessible ports.
Mitigation strategies should prioritize immediate patching of Junos OS and Junos OS Evolved to versions that include fixes for this specific l2cpd validation logic. In the absence of an available update, network administrators should disable MVRP on interfaces that do not strictly require dynamic VLAN registration capabilities, thereby removing the attack surface entirely. Additionally implementing strict port security features such as limiting MAC addresses and enabling storm control can help mitigate the volume of crafted frames reaching the control plane. Regular monitoring for unusual CPU spikes or process restarts associated with l2cpd may also serve as an early detection mechanism for ongoing exploitation attempts in vulnerable environments.