Junos secure-dot1xd: EAPOL frame on an 802.1X interface gives root code execution

CVSS 8.7CVE-2026-102015Firmware, BMC & network fabriccurated

Impact

An EAPOL frame sent to an 802.1X-authenticated interface overflows a heap buffer in secure-dot1xd and yields code execution as root, or a denial of service. The frame is processed before the port is authenticated, so the attacker needs only physical or L2 access to an access port - the exact pre-auth position 802.1X exists to contain. In a datacenter that means a patch panel, a provisioning port, or any port an unverified machine is plugged into.

Who can reach it

An unauthenticated attacker on the same L2 segment as an 802.1X-enabled interface, able to send EAPOL frames. No credentials needed.

What to do

Upgrade Junos OS / Junos OS Evolved to a release in Juniper JSA112187; the upgrade reboots the switch, so each access switch needs a window. Interim containment is physical: keep unused 802.1X ports administratively down and treat ports reachable by untrusted hardware as hostile until patched.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102015 https://supportportal.juniper.net/JSA112187

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.