Database/Firmware, BMC & network fabric
Junos phone-home daemon: rogue DHCP server injects OS commands and runs them as root
Impact
The phone-home daemon passes data from DHCP into an OS command without neutralising special elements, so a rogue DHCP server on the segment gets arbitrary command execution as root on EX, SRX and QFX devices. This fires during zero-touch provisioning, before any configuration or credential exists on the box, which means a switch can be owned the first time it is powered on in the rack. For operators who bring up GPU pods by racking and booting switches from a provisioning VLAN, anything able to answer DHCP on that VLAN owns the fabric hardware.
Who can reach it
An unauthenticated attacker adjacent on the provisioning segment, able to answer the device's DHCP request before the legitimate server. No credentials. Affects EX, SRX and QFX platforms running phone-home.
What to do
Upgrade Junos OS / Junos OS Evolved to a fixed release per Juniper JSA112187; the upgrade reboots the device. Operationally, treat the provisioning VLAN as a trusted enclave: isolate it from tenant and general-purpose networks, enable DHCP snooping upstream where available, and disable phone-home on devices that are already provisioned.
References
Related entries
- Junos phone-home daemon: crafted DHCP SZTP bootstrap message overflows a stack buffer, root executionCVE-2026-102061 · Juniper Junos OS / Junos OS Evolved phcd (Secure-ZTP DHCP bootstrap parsing)High
- Junos rpd: malformed BGP MCAST-VPN updates from an eBGP peer hit an assertion and crash rpdCVE-2026-102064 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-VPN update parsing)High
- Junos rpd: malformed BGP SRv6 service route crashes the routing daemon when SRv6 dynamic tunnels are enabledCVE-2026-102065 · Juniper Junos OS / Junos OS Evolved rpd (BGP-signaled SRv6 service routes, dynamic tunnels)High
- Junos OS: stack overflow in the dot1x daemon lets an ICCP peer crash or own a Fusion ADCVE-2026-102069 · Juniper Junos OS dot1x daemon on Fusion Aggregation Devices (ICCP sync)High
- Junos OS MX/SPC3: malformed IPv6 packets exhaust NAT sessions until the device is rebootedCVE-2026-102077 · Juniper Junos OS Packet Forwarding Engine on MX Series with SPC3 (source NAT session handling)High
- Junos OS SRX/MX with SPC3: PFE memory leak under connection churn causes complete traffic lossCVE-2026-102081 · Juniper Junos OS Packet Forwarding Engine on SRX4000/SRX5000 and MX with SPC3 (service plugin memory leak)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.