Database/Firmware, BMC & network fabric
Junos OS on SRX: format string flaw in ipfd gives root code execution from an impersonated HTTPS feed server
Impact
ipfd passes externally controlled data from a configured HTTPS feed server into a format string, letting an unauthenticated attacker who controls or impersonates that server execute code with root privileges. This is a distinct mechanism from the SQL injection in the same daemon (CVE-2026-101997) and is fixed in the same bulletin, but it is reached through the HTTPS feed response rather than the Security Intelligence database path. The outcome is root on the device enforcing perimeter policy for everything behind it, obtained by subverting one outbound HTTPS connection the firewall makes by design.
Who can reach it
Network, unauthenticated, with attack requirements present: the attacker must compromise or impersonate the HTTPS feed server the SRX is configured to contact - an on-path position or a trusted-chain compromise. Devices with no feed configured are not exposed.
What to do
Upgrade Junos OS per Juniper advisory JSA112186; the NVD record lists no fixed versions. Shorter-term, remove the feed configuration or confirm the device validates the feed server's certificate chain over a controlled egress path. Patching reboots the chassis, so plan HA failover or a window.
References
Related entries
- Junos OS Evolved kernel: crafted TCP packet panics the switch when BGP/LDP key-chain auth is usedCVE-2026-102068 · Juniper Junos OS Evolved kernel (TCP key-chain authentication for BGP/LDP)Critical
- Junos OS: reachable assertion in the TWAMP client lets one TCP packet kill rmopdCVE-2026-102070 · Juniper Junos OS rmopd (TWAMP client)Critical
- Junos OS on SRX: malformed ADVPN peer attributes overflow the VPN daemon and take over the deviceCVE-2026-102084 · Juniper Junos OS VPN daemon on SRX Series (ADVPN peer message validation)Critical
- Junos rpd: BGP updates processed by BMP route monitoring overflow a stack buffer, up to root executionCVE-2026-33789 · Juniper Junos OS / Junos OS Evolved rpd (BGP Monitoring Protocol route export)Critical
- Linux kernel bnxt_re: doorbell page allocation reports success when ioremap fails, leaving unwound driver stateCVE-2026-72496 · Linux kernel bnxt_re RoCE driver (bnxt_qplib_alloc_dpi doorbell ioremap error path)Critical
- Arista EOS gNPSI: unauthenticated request yields arbitrary code execution on the switchCVE-2026-73456 · Arista EOS (gNPSI - gRPC Network Packet Sampling Interface)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.