Junos OS EUVD-2026-101373

Exploitation requires that LLDP traffic be received on an interface configured with Unified Access Policy (UAP) enabled - this is the explicit precondition named in the description and is not a default state on all interfaces. Because LLDP is a link-local Layer-2 protocol, the attacker must be directly adjacent on the same network segment (AV:A), not routable across the internet. No authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors that reduce real-world risk: the required Layer-2 adjacency, the non-default Unified Access Policy configuration, and the need for the vulnerable l2cpd code path to be reachable on the specific affected Junos / Junos OS Evolved versions listed in EUVD-2026-101373.

This is a credible, high-priority networking vulnerability but not a universal emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), scoring 8.7 - consistent with the description's claim of denial of service or arbitrary code execution as root. The key risk modifier is AV:A (Adjacent), not AV:N: LLDP is a link-local Layer-2 protocol, so the attacker must be on the same broadcast/physical segment as a vulnerable interface, which meaningfully narrows remote mass-exploitation compared to an internet-facing flaw. Exploitation is further gated by a non-default precondition - the interface must have Unified Access Policy enabled - so the realistic exposed population is a subset of all Junos deployments. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the priority rests on the severity and root-level RCE potential rather than on observed attacker activity. Note one signal nuance: the vendor marks subsequent-system availability as SA:L and VI/VC/VA:H, reflecting that a compromised control-plane daemon (l2cpd) can degrade device and downstream network availability. Overall: a genuine high-severity bug worth prompt patching on affected, UAP-enabled, Layer-2-exposed devices, but the adjacency and configuration gating make it a targeted rather than internet-wide threat.

An attacker with Layer-2 adjacency to a Junos or Junos OS Evolved device - for example on a compromised host, rogue device, or untrusted access port - sends crafted LLDP frames to an interface that has Unified Access Policy enabled. The malformed LLDP data overflows a stack buffer in the l2cpd process, crashing the daemon (denial of service) or, in the worst case, executing attacker-controlled code with root privileges. No public exploit code is identified at time of analysis, and exploitation requires no authentication or user interaction.