Junos OS CVE-2026-102062

Exploitation requires the SRX device to be configured to use an HTTPS feed server (e.g., a Security Intelligence / SecIntel or similar externally-fetched feed source), AND the attacker must either compromise that configured feed server or successfully impersonate it (TLS interception / MITM on the SRX-to-feed path). Without a configured HTTPS feed server, the ipfd attack surface is not reached. The key LIMITING factors are therefore: (1) a non-default dependency on an external HTTPS feed being configured, and (2) the need for a privileged position - control of or an on-path position to the feed server - captured by the CVSS 4.0 AT:P metric. These conditions mean the flaw is not exploitable by arbitrary internet-based attackers against a default configuration, despite PR:N/UI:N.

This is a genuinely high-priority flaw but with an important exploitation precondition that tempers its raw CVSS 9.2 (CVSS 4.0). The vector AV:N/AC:L/PR:N/UI:N confirms an unauthenticated, network-based, low-complexity attack against the device with full VC:H/VI:H/VA:H impact and code execution as root - a severe outcome for a security appliance. However, the AT:P (Attack Requirements: Present) metric and the description are mutually consistent and critical: exploitation is NOT arbitrary from the open internet. The attacker must first control the configured HTTPS feed server, either by compromising it or by impersonating it (e.g., via TLS/MITM interception on the path between the SRX and its feed source). This is a meaningful barrier that shifts the threat toward adversaries with an existing privileged network position or a supply-chain foothold, rather than opportunistic mass scanning. No EPSS score, KEV listing, or POC is present in the supplied data, so there is no evidence of active exploitation or public exploit code - exploitation status is 'no public exploit identified at time of analysis'. Net assessment: a real priority for organizations running SRX SecIntel/feed configurations, but the required feed-server control (reflected in AT:P) makes widespread untargeted exploitation unlikely; treat as a high-value target for sophisticated actors rather than a drive-by internet threat.

An attacker who has compromised the organization's configured HTTPS feed server - or who can impersonate it via a man-in-the-middle position on the feed path - returns a malicious feed response containing attacker-controlled format string specifiers. The ipfd daemon on the SRX parses this response unsafely (CWE-134), letting the attacker read/write memory and execute arbitrary code as root on the firewall. No public exploit code is identified in the available data; exploitation requires the privileged feed-server position described above.