Junos OS on SRX: SQL injection in ipfd lets a Security Intelligence feed execute code as root

Impact

The ipfd daemon stores Security Intelligence feed data without neutralising SQL metacharacters, and the advisory states this allows an unauthenticated network-based attacker to execute code with root privileges through a configured Security Intelligence feed connection. The trust assumption that breaks here is the feed: an operator who subscribes the firewall to a threat feed has handed that channel the ability to run code as root on the device if an attacker can influence or impersonate it. That is root on the perimeter device for a GPU fleet, reached without touching the management VLAN at all.

Who can reach it

Network, unauthenticated, with attack requirements present: the attacker must be able to control, compromise or impersonate the Security Intelligence feed the SRX is configured to pull from. Devices with no Security Intelligence feed configured are not exposed.

What to do

Upgrade Junos OS per Juniper advisory JSA112186 - the NVD record carries no fixed version list, so take it from the bulletin. Interim hardening is to verify the feed endpoint's certificate pinning and egress path, or disable the Security Intelligence feed, which removes the vulnerable input. Expect a chassis reboot for the upgrade; fail over to the HA peer or schedule a window.

References

Related entries

• Junos OS on SRX: XML injection in utmd lets a malicious URL-feed server commit device configuration as rootCVE-2026-102037 · Juniper Junos OS on SRX Series (utmd, custom URL-feed server response parsing)Critical
• Junos OS on SRX: format string flaw in ipfd gives root code execution from an impersonated HTTPS feed serverCVE-2026-102062 · Juniper Junos OS on SRX Series (ipfd, HTTPS feed server response handling)Critical
• Junos OS Evolved kernel: crafted TCP packet panics the switch when BGP/LDP key-chain auth is usedCVE-2026-102068 · Juniper Junos OS Evolved kernel (TCP key-chain authentication for BGP/LDP)Critical
• Junos OS: reachable assertion in the TWAMP client lets one TCP packet kill rmopdCVE-2026-102070 · Juniper Junos OS rmopd (TWAMP client)Critical
• Junos OS on SRX: malformed ADVPN peer attributes overflow the VPN daemon and take over the deviceCVE-2026-102084 · Juniper Junos OS VPN daemon on SRX Series (ADVPN peer message validation)Critical
• Junos rpd: BGP updates processed by BMP route monitoring overflow a stack buffer, up to root executionCVE-2026-33789 · Juniper Junos OS / Junos OS Evolved rpd (BGP Monitoring Protocol route export)Critical