Database/Firmware, BMC & network fabric
Junos cfmd: CFM message to a down-MEP executes code as root with enhanced CFM mode enabled
Impact
A specific Connectivity Fault Management message sent to a configured down-MEP overflows a stack buffer in cfmd and runs code as root, or crashes the daemon. It affects MX Series on Junos OS and PTX Series on Junos OS Evolved with enhanced CFM mode - the aggregation and core platforms, where a compromise reaches more traffic than a leaf would. The attacker needs only link adjacency to an interface with a down-MEP, no credentials.
Who can reach it
An unauthenticated attacker on a network adjacent to an interface with a configured down-MEP, on an MX or PTX device with enhanced CFM mode enabled.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release from Juniper JSA112187; the upgrade reboots the chassis, which on an MX or PTX core device is the most expensive window in this advisory - plan redundancy first. Removing down-MEP configuration or disabling enhanced CFM on interfaces facing untrusted segments removes the trigger meanwhile.
References
Related entries
- Junos OS: stack overflow in jdhcpd lets an adjacent attacker break DHCP, relay and ZTPCVE-2026-102057 · Juniper Junos OS jdhcpd (DHCP client response handling)High
- Junos phone-home daemon: rogue DHCP server injects OS commands and runs them as rootCVE-2026-102059 · Juniper Junos OS / Junos OS Evolved phcd (phone-home daemon) on EX, SRX, QFXHigh
- Junos phone-home daemon: crafted DHCP SZTP bootstrap message overflows a stack buffer, root executionCVE-2026-102061 · Juniper Junos OS / Junos OS Evolved phcd (Secure-ZTP DHCP bootstrap parsing)High
- Junos rpd: malformed BGP MCAST-VPN updates from an eBGP peer hit an assertion and crash rpdCVE-2026-102064 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-VPN update parsing)High
- Junos rpd: malformed BGP SRv6 service route crashes the routing daemon when SRv6 dynamic tunnels are enabledCVE-2026-102065 · Juniper Junos OS / Junos OS Evolved rpd (BGP-signaled SRv6 service routes, dynamic tunnels)High
- Junos OS: stack overflow in the dot1x daemon lets an ICCP peer crash or own a Fusion ADCVE-2026-102069 · Juniper Junos OS dot1x daemon on Fusion Aggregation Devices (ICCP sync)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.