CVE-2026-102061 in Junos OS
Summary
by MITRE • 10/15/2026
A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message.
This issue only affects platforms that support Secure-ZTP.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves a critical stack-based buffer overflow within the phone-home daemon, known as phcd, which is a core component of Juniper Networks Junos OS and Junos OS Evolved operating systems. This specific flaw resides in the handling of DHCP SZTP bootstrap messages, where Secure-Zero Touch Provisioning functionality processes incoming network configuration data. The security impact is severe because it allows an adjacent unauthenticated attacker to execute arbitrary code with root-level privileges on the affected device. Adjacent attackers are typically those who can reach the target system over a local area network or through a compromised intermediate host, meaning that any entity connected to the same broadcast domain as the vulnerable Juniper equipment poses a potential threat vector. The absence of authentication requirements for this specific message processing path significantly lowers the barrier for exploitation, enabling remote code execution without prior credentials.
From a technical perspective, stack-based buffer overflows occur when a program writes more data to a fixed-length block of memory on the call stack than it is allocated to hold. In the context of phcd, the parsing logic for DHCP SZTP bootstrap messages likely fails to adequately validate or bound-check input lengths before copying them into local buffers. This lack of rigorous boundary checking allows an attacker to craft a maliciously sized DHCP option that overwrites adjacent memory locations on the stack. Such overwrites can corrupt return addresses or function pointers, thereby hijacking the control flow of the application. By carefully crafting the payload, an attacker can redirect execution to shellcode injected into the buffer itself or leverage Return Oriented Programming techniques to chain existing executable code snippets within the binary. The ultimate result is the complete compromise of the device's integrity and confidentiality, as root access grants unrestricted control over system configurations, network routing tables, and sensitive operational data.
The operational impact of this vulnerability extends beyond simple remote code execution. Since phcd is involved in Zero Touch Provisioning processes, compromising it may allow an attacker to manipulate initial device configuration states during deployment or maintenance windows. This could lead to persistent backdoors being installed at the highest privilege level, facilitating long-term unauthorized access. Furthermore, because Secure-ZTP relies on secure bootstrapping mechanisms, undermining this component potentially weakens the entire chain of trust for network infrastructure devices. Attackers can leverage root access to pivot into other parts of the internal network, exfiltrate sensitive information, or disrupt critical services by altering routing protocols and firewall rules. The scope is limited to platforms that support Secure-ZTP, which narrows the attack surface but does not diminish the severity for those specific deployments where automated provisioning is enabled.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Juniper Networks has released software updates that patch this buffer overflow by implementing proper input validation and bounds checking within the phcd module handling DHCP SZTP messages. Administrators should immediately apply these vendor-provided patches to all affected devices running vulnerable versions of Junos OS or Junos OS Evolved. In environments where immediate patching is not feasible, network segmentation strategies can be employed to restrict access to the management interfaces and provisioning networks from untrusted zones. Implementing strict firewall rules that filter DHCP traffic at layer three boundaries can also reduce exposure by preventing unauthorized hosts from sending crafted bootstrap messages. Additionally, enabling logging for phcd activities allows security teams to detect anomalous behavior indicative of exploitation attempts.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-120, which classifies buffer copies without checking size limits as a fundamental software defect leading to memory corruption issues. The attack vector corresponds to MITRE ATT&CK technique T1190, Exploit Public-Facing Application, although the adjacency requirement places it more specifically within lateral movement or local exploitation contexts depending on network topology. It also relates to CWE-787, Out-of-bounds Write, which describes writing data beyond allocated memory boundaries. Understanding these classifications helps in mapping the vulnerability to broader security frameworks and ensuring that similar flaws are prevented through secure coding practices such as using safe string handling functions and enforcing strict input sanitization protocols during development of network daemon components.