Junos OS: stack overflow in authd gives root on the device to whoever controls the RADIUS server

CVSS 8.7CVE-2026-102014Firmware, BMC & network fabriccurated

Impact

A malicious RADIUS response overflows a stack buffer in authd and can execute code as root on the Junos device. Whoever can influence the configured RADIUS server - by compromising it, or by sitting on the path and spoofing responses to an unauthenticated transport - owns the switch or router outright, which means the ability to reroute, mirror, or black-hole traffic for the GPU fabric behind it. This is the network admin's own authentication infrastructure being turned into a device-takeover path, so the blast radius is every device pointed at the same RADIUS server.

Who can reach it

Adjacent network, no authentication on the device itself, but the attacker must be able to supply RADIUS responses - either by holding the RADIUS server or by being in a position to forge its replies to the device.

What to do

Upgrade to a fixed Junos release per Juniper advisory JSA112188; the record names no fixed versions, so check the advisory for your train. The upgrade reboots the device. In the meantime, treat the RADIUS servers as tier-0 infrastructure, keep the RADIUS path on a trusted management segment, and confirm the device only accepts responses from the configured servers.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102014 https://supportportal.juniper.net/JSA112188

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.