Junos OS Evolved bootzd: crafted DHCP response gives root command execution on the switch

CVSS 9.3CVE-2026-101967Firmware, BMC & network fabriccurated

Impact

An unauthenticated attacker with a foothold on the management LAN can answer the switch's ZTP DHCP request with a crafted response and run arbitrary commands as root on a Junos OS Evolved device. In a GPU datacenter these devices are the leaf/spine and management switches that carry tenant traffic, storage traffic and the out-of-band network; root on one means the attacker can mirror or redirect traffic between tenants, alter ACLs, or hold a persistent position inside the fabric that no host-level control will see. The attack needs no credentials, only a DHCP server that answers faster than the legitimate one on the provisioning segment, so any device that re-runs ZTP after a chassis replacement or a factory reset is exposed. Scored 9.3 by Juniper.

Who can reach it

Adjacent network: anyone able to send DHCP responses on the management/provisioning LAN the switch boots on. No authentication required.

What to do

Apply the Junos OS Evolved release called out in Juniper advisory JSA112250; a Junos upgrade takes the switch out of service for a reboot, so plan it per fabric element and respect redundancy before draining. Until then, disable zero-touch provisioning on devices that do not need it and restrict DHCP on the provisioning segment to trusted servers with DHCP snooping. The record does not list the fixed versions - read JSA112250 for the exact releases.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101967 https://supportportal.juniper.net/JSA112250

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.