Junos OS on SRX: malformed ADVPN peer attributes overflow the VPN daemon and take over the device

CVSS 9.2CVE-2026-102084Firmware, BMC & network fabriccurated

Impact

An SRX configured for AutoDiscovery VPN that receives a peer message with malformed attributes suffers a buffer overflow in the VPN daemon, allowing remote code execution and complete control of the firewall. An SRX in front of a GPU estate is the policy enforcement point between tenants, sites and the outside; owning it means rewriting or disabling that policy and reading whatever crosses it. The practical barrier is real: the attacker must hold the shared secret to impersonate an ADVPN peer, or have already compromised one, so this is primarily a lateral-movement path from one compromised VPN endpoint to the hub.

Who can reach it

Network. The attacker must be able to speak as an ADVPN peer - either by having acquired the shared secret or by having compromised an existing peer device. Only SRX devices configured for ADVPN are affected.

What to do

Upgrade per Juniper advisory JSA112173: 23.2R2-S7.7 or later for earlier versions, 23.4R2-S7, 24.2R2-S4, 24.4R2-S3, 25.2R2, or 25.4R1-S3 for those branches. Upgrading an SRX is a reboot and, on a chassis cluster, a failover per node; on a standalone firewall it is a traffic outage. Until then, rotate ADVPN shared secrets if there is any doubt about peer integrity and audit the peers that can reach the hub.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102084 https://supportportal.juniper.net/JSA112173

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.