Junos OS: stack overflow in the dot1x daemon lets an ICCP peer crash or own a Fusion AD

Impact

On Junos devices acting as Fusion Aggregation Devices with dot1x synchronization enabled, an attacker able to act as the configured ICCP peer can overflow a stack buffer in the dot1x daemon, causing a denial of service and potentially code execution as root. The ICCP peer is the other half of a redundant aggregation pair, so this is a lateral path: compromise one aggregation device and you can take or crash its partner, which removes the redundancy that the access layer under the fleet depends on. It only applies to the Fusion satellite topology with dot1x sync configured - most spine/leaf GPU fabrics do not run it, so check the configuration before scheduling anything.

Who can reach it

Adjacent network, no device authentication needed beyond being the configured ICCP peer - an attacker must already be, or have compromised, the peer aggregation device. Only applies when dot1x synchronization is enabled in a Junos Fusion satellite topology.

What to do

Upgrade to a fixed Junos release per Juniper advisory JSA112188; the record does not list fixed versions. The upgrade is a reboot of each aggregation device, which on a redundant pair can be rolled one side at a time. If Junos Fusion or dot1x synchronization is not in use, you are not exposed and no maintenance window is needed.

References

Related entries

• Junos OS MX/SPC3: malformed IPv6 packets exhaust NAT sessions until the device is rebootedCVE-2026-102077 · Juniper Junos OS Packet Forwarding Engine on MX Series with SPC3 (source NAT session handling)High
• Junos OS SRX/MX with SPC3: PFE memory leak under connection churn causes complete traffic lossCVE-2026-102081 · Juniper Junos OS Packet Forwarding Engine on SRX4000/SRX5000 and MX with SPC3 (service plugin memory leak)High
• Junos OS on SRX: stack overflow in iked lets an authenticated VPN client run code as rootCVE-2026-102174 · Juniper Junos OS on SRX Series (iked, remote-access VPN authentication and JIMS identity publishing)High
• Junos OS: buffer overflow in the SDK service process can compromise the Routing EngineCVE-2026-102176 · Juniper Junos OS SDK service process (JDAF routing instance)High
• Junos rpd: out-of-bounds write in EVPN route processing when the l2vpn-evpn RIB telemetry sensor is subscribedCVE-2026-102179 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, l2vpn-evpn RIB telemetry sensor)High
• Junos rpd: stack buffer overflow on a crafted BGP route attribute while a BGP RIB telemetry subscription is activeCVE-2026-102180 · Juniper Junos OS / Junos OS Evolved routing protocol daemon (rpd, BGP RIB streaming telemetry)High