Database/Firmware, BMC & network fabric
Junos jdhcpd: malformed DHCPv4 server response gives root code execution on the device
Impact
When the DHCPv4 local-client feature is used, a malformed DHCP server response overflows a stack buffer in jdhcpd and yields root code execution or a denial of service. The attacker only has to answer the device's own DHCP request faster than the legitimate server, which any host on the same segment can attempt. Devices that pull a management address by DHCP - common for switches during and after provisioning - are the exposed set.
Who can reach it
An unauthenticated attacker adjacent on a segment where the device acts as a DHCPv4 client, able to send a rogue or spoofed DHCP response. No credentials needed.
What to do
Upgrade Junos OS / Junos OS Evolved per the fixed releases in Juniper JSA112187; the upgrade reboots the device. Where a static management address is acceptable, removing the DHCPv4 local-client configuration eliminates the exposure immediately; otherwise keep the provisioning segment isolated from tenant and untrusted hosts.
References
Related entries
- Junos cfmd: CFM message to a down-MEP executes code as root with enhanced CFM mode enabledCVE-2026-102055 · Juniper Junos OS cfmd on MX Series / Junos OS Evolved on PTX Series (enhanced CFM)High
- Junos OS: stack overflow in jdhcpd lets an adjacent attacker break DHCP, relay and ZTPCVE-2026-102057 · Juniper Junos OS jdhcpd (DHCP client response handling)High
- Junos phone-home daemon: rogue DHCP server injects OS commands and runs them as rootCVE-2026-102059 · Juniper Junos OS / Junos OS Evolved phcd (phone-home daemon) on EX, SRX, QFXHigh
- Junos phone-home daemon: crafted DHCP SZTP bootstrap message overflows a stack buffer, root executionCVE-2026-102061 · Juniper Junos OS / Junos OS Evolved phcd (Secure-ZTP DHCP bootstrap parsing)High
- Junos rpd: malformed BGP MCAST-VPN updates from an eBGP peer hit an assertion and crash rpdCVE-2026-102064 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-VPN update parsing)High
- Junos rpd: malformed BGP SRv6 service route crashes the routing daemon when SRv6 dynamic tunnels are enabledCVE-2026-102065 · Juniper Junos OS / Junos OS Evolved rpd (BGP-signaled SRv6 service routes, dynamic tunnels)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.