Database/Firmware, BMC & network fabric
Junos OS Evolved gRPC daemon: format string in gNMI messages risks root code execution
Impact
An externally controlled format string in the gNMI service lets an authenticated attacker disrupt telemetry, read memory contents, or potentially execute code at root level on the device. Fabric telemetry is how a GPU datacenter sees congestion and link errors on the InfiniBand/Ethernet side, and gNMI collectors usually hold credentials that are shared across every switch in the fleet - so a single compromised collector credential reaches the whole fabric. The possibility of root code execution makes this more than a monitoring outage. Juniper scored it 8.7; the record does not state how far code execution has been demonstrated.
Who can reach it
Network: an attacker with low-privilege credentials for the device's gNMI/gRPC service - typically whatever the telemetry collector uses. Authentication required.
What to do
Upgrade to the fixed Junos OS Evolved release per JSA112250, which means a reboot per device. Meanwhile, restrict the gNMI listener to the collector's address, rotate collector credentials, and disable the gRPC service on devices that are not streaming telemetry. No fixed version appears in this record.
References
Related entries
- Junos OS: NULL dereference in pkid during CMP enrollment is a remote denial of serviceCVE-2026-101973 · Juniper Junos OS pkid (CMP certificate enrollment)High
- Junos rpd: malformed BGP update from a peer without four-octet-AS capability causes an out-of-bounds writeCVE-2026-101976 · Juniper Junos OS / Junos OS Evolved rpd (BGP four-octet-AS attribute handling)High
- Junos rpd: eBGP peer causes a persistent routing-daemon outage when ephemeral configuration is usedCVE-2026-101977 · Juniper Junos OS / Junos OS Evolved rpd (ephemeral configuration database)High
- Junos OS Evolved bootzd on PTX: crafted gRPC provisioning response executes commands as rootCVE-2026-101978 · Juniper Junos OS Evolved bootzd on PTX Series (ZTP gRPC response handling)High
- Junos authd: SNMP read access escalates to root code execution via a stack overflowCVE-2026-101979 · Juniper Junos OS / Junos OS Evolved authd (SNMP request handling)High
- Junos rpd: malformed LDP Label Mapping message crashes rpd or executes arbitrary codeCVE-2026-101981 · Juniper Junos OS / Junos OS Evolved rpd (LDP Label Mapping message parsing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.