CVE-2026-102060 in Junos OS
Summary
by MITRE • 10/14/2026
A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on ACX Series allows an unauthenticated adjacent attacker to cause a denial of service via an IGMPv3 membership report received on a directly connected network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability resides within the Routing Protocol Daemon, commonly referred to as rpd, which is a critical component responsible for managing dynamic routing protocols and neighbor discovery in Juniper Networks operating environments. Specifically affecting MX Series routers running Junos OS and ACX Series devices utilizing Junos OS Evolved, this flaw manifests when the system processes Internet Group Management Protocol version 3 membership reports received from directly connected networks. The core technical deficiency is a NULL pointer dereference error that occurs during the parsing or handling of these specific multicast control plane messages. When an attacker sends a crafted IGMPv3 membership report to the device, the rpd process fails to properly validate input parameters before attempting to access memory locations associated with routing table entries or neighbor state structures. This lack of rigorous boundary checking leads the application to reference a memory address that has not been initialized or allocated, triggering a segmentation fault and causing an immediate crash of the daemon process.
From an operational perspective, this vulnerability poses a significant risk to network availability because it allows for remote denial of service attacks without requiring any form of authentication. An adversary positioned on the same local area network segment as the vulnerable device can exploit this condition by simply transmitting malformed IGMPv3 packets. The immediate consequence is the termination of the rpd process, which typically results in a loss of routing protocol adjacencies and potential instability in route calculation depending on high-availability configurations such as non-stop routing or graceful restart mechanisms. If these redundancy features are not properly configured or if they fail to recover quickly enough from the daemon crash, the device may experience prolonged periods where it cannot participate effectively in dynamic routing exchanges, leading to traffic blackholing and connectivity disruptions for downstream networks that rely on this router for path selection.
This vulnerability is classified under CWE-476, which denotes a NULL Pointer Dereference, indicating a failure of the software to check for null values before dereferencing pointers during execution. In terms of offensive security frameworks, this exploit aligns with MITRE ATT&CK technique T1498.002, Network Denial of Service via Resource Exhaustion or Flooding, specifically through network layer attacks that target control plane resources rather than data plane bandwidth. The attack vector is classified as adjacent because the attacker must have direct Layer 2 connectivity to the victim interface, limiting its scope compared to remote internet-based exploits but making it highly feasible for insider threats or compromised hosts on trusted internal segments.
Mitigation strategies primarily involve applying vendor-supplied software updates that patch the underlying code defect within the rpd module. Until patches are available, network administrators should consider implementing strict access control lists on interfaces facing untrusted networks to filter out IGMP traffic if multicast routing is not actively required in those segments. Additionally, enabling rate limiting for IGMP messages can help mitigate the impact of volumetric attempts to trigger the crash, although a single crafted packet may be sufficient to exploit this specific logic error. Regular monitoring of system logs for rpd restarts and ensuring that high-availability features are correctly tuned to minimize downtime during unexpected daemon failures are also recommended defensive measures to maintain service continuity in critical infrastructure environments.