Database/Firmware, BMC & network fabric
Junos phone-home daemon: crafted DHCP SZTP bootstrap message overflows a stack buffer, root execution
Impact
A crafted DHCP Secure-ZTP bootstrap message overflows a stack buffer in phcd and executes code as root. The bug is in the parsing of the bootstrap message itself, so it is reached before Secure-ZTP has validated anything - the secure variant of zero-touch provisioning does not protect against it. Only platforms that support Secure-ZTP are affected, and the window is during bring-up, when the device has no configuration to fall back on.
Who can reach it
An unauthenticated attacker adjacent on the provisioning segment, able to deliver a crafted DHCP SZTP bootstrap message. No credentials. Limited to Secure-ZTP-capable platforms.
What to do
Upgrade Junos OS / Junos OS Evolved per Juniper JSA112187; the upgrade reboots the device. Until then, keep the provisioning segment isolated and only connected while a device is actually being bootstrapped, and disable phone-home on devices already in service.
References
Related entries
- Junos rpd: malformed BGP MCAST-VPN updates from an eBGP peer hit an assertion and crash rpdCVE-2026-102064 · Juniper Junos OS / Junos OS Evolved rpd (BGP MCAST-VPN update parsing)High
- Junos rpd: malformed BGP SRv6 service route crashes the routing daemon when SRv6 dynamic tunnels are enabledCVE-2026-102065 · Juniper Junos OS / Junos OS Evolved rpd (BGP-signaled SRv6 service routes, dynamic tunnels)High
- Junos OS: stack overflow in the dot1x daemon lets an ICCP peer crash or own a Fusion ADCVE-2026-102069 · Juniper Junos OS dot1x daemon on Fusion Aggregation Devices (ICCP sync)High
- Junos OS MX/SPC3: malformed IPv6 packets exhaust NAT sessions until the device is rebootedCVE-2026-102077 · Juniper Junos OS Packet Forwarding Engine on MX Series with SPC3 (source NAT session handling)High
- Junos OS SRX/MX with SPC3: PFE memory leak under connection churn causes complete traffic lossCVE-2026-102081 · Juniper Junos OS Packet Forwarding Engine on SRX4000/SRX5000 and MX with SPC3 (service plugin memory leak)High
- Junos OS on SRX: stack overflow in iked lets an authenticated VPN client run code as rootCVE-2026-102174 · Juniper Junos OS on SRX Series (iked, remote-access VPN authentication and JIMS identity publishing)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.