CVE-2026-102177 in Junos OS
Summary
by MITRE • 10/14/2026
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The identified vulnerability represents a critical memory corruption flaw within the Internet Routing Protocol Daemon, known as rpd, which serves as the core engine for dynamic routing protocols in Juniper Networks operating systems including both Junos OS and Junos OS Evolved. This specific defect is classified as an Out-of-bounds Write, a severe category of software error where a program writes data to a memory location outside the intended buffer boundaries. The exploitation vector requires no authentication from the attacker, provided they are positioned on the same network segment or have adjacent connectivity to the affected device. This lack of authentication requirement significantly lowers the barrier for entry, allowing any actor with layer two or layer three adjacency capabilities to trigger the flaw without needing valid credentials or prior compromise of the system.
The technical mechanism behind this vulnerability is triggered specifically when certain advanced high-availability features are enabled on the router. Specifically, the configuration combination of IS-IS link protection and backup-selection creates a state within the routing daemon that fails to properly validate input parameters during packet processing. When an adjacent device sends crafted Intermediate System-to-Intermediate System packets containing malformed or excessively long fields related to these specific feature interactions, the rpd process attempts to write this data into memory buffers allocated for normal protocol operations. Because the bounds checking logic is flawed in this particular code path, the write operation overwrites adjacent memory structures. This corruption can lead to immediate segmentation faults causing a crash of the routing daemon, or more insidiously, it may allow an attacker to execute arbitrary code by manipulating return addresses or function pointers stored in the overwritten memory regions.
From an operational perspective, the primary impact is a denial of service against the network infrastructure. If the vulnerability results in a process restart rather than full system compromise, the router will experience frequent reboots of its control plane components. This leads to intermittent loss of routing adjacency, causing traffic black holes and significant instability across the routed domain. In scenarios where memory corruption allows for code execution, the impact escalates to complete host takeover, granting the attacker unrestricted access to the network device's management interface and underlying operating system. This could facilitate further lateral movement within the enterprise network, interception of sensitive routing updates, or use of the compromised router as a pivot point for attacks against other internal systems. The presence of this flaw in both Junos OS and Junos OS Evolved indicates that the root cause is deeply embedded in the shared codebase responsible for handling IS-IS protocol state machines and backup path selection logic.
Industry standard classifications place this vulnerability under Common Weakness Enumeration identifier CWE-787, which denotes out-of-bounds write vulnerabilities involving memory corruption. In terms of tactical behavior within an attack lifecycle, this flaw aligns with MITRE ATT&CK techniques related to initial access via network service exploitation and potentially privilege escalation if the daemon runs with elevated privileges. The lack of authentication requirement places it in categories associated with unauthenticated remote code execution or denial of service attacks against critical infrastructure services. Security teams should prioritize patching based on these classifications, recognizing that out-of-bounds writes are among the most dangerous software defects due to their potential for arbitrary code execution and stability degradation.
Mitigation strategies must focus primarily on applying vendor-supplied security patches as soon as they become available from Juniper Networks support channels. Until patches can be deployed, network architects should consider disabling IS-IS link protection and backup-selection features if these high-availability mechanisms are not strictly required by the specific design of the network segment in question. Additionally, implementing strict access control lists on interfaces running IS-IS to restrict adjacency formation only to trusted peers with known IP addresses can reduce the attack surface for adjacent unauthenticated attackers. Network monitoring tools should be configured to detect anomalous routing protocol traffic patterns or frequent process restarts associated with rpd, which may indicate active exploitation attempts. Regular audits of configuration files to ensure that unnecessary advanced features are disabled on edge devices further reduces exposure to such memory corruption vulnerabilities inherent in complex protocol implementations.