Junos OS EUVD-2026-101388

Exploitation requires three concrete prerequisites: (1) the target platform must support Secure-ZTP - the advisory explicitly states the issue only affects Secure-ZTP-capable platforms; (2) the device must be actively performing the DHCP SZTP bootstrap/provisioning process so that phcd is listening for and parsing bootstrap messages; and (3) the attacker must be network-adjacent (AV:A - same Layer-2/logical segment, not routable from the internet), though no authentication is needed (PR:N) and no user interaction is required (UI:N). The limiting factors are significant: non-ZTP deployments and already-provisioned devices not in bootstrap are not exposed, and the adjacency requirement excludes remote internet-based attackers, meaning realistic risk is confined to local/management-network adversaries during device provisioning.

This is a genuinely serious, high-priority flaw where multiple signals align: the CWE-121 stack-based buffer overflow yields arbitrary code execution as root, and the vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.7 High) indicates no authentication and low complexity. The key tempering factor is the attack vector: AV:A means the attacker must be adjacent (same Layer-2/logical network segment), not reachable from the open internet, which substantially narrows the realistic attacker population versus an AV:N flaw. Exploitation is further gated to devices that support and are actively using Secure-ZTP during the DHCP bootstrap phase. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. The 4.0 vector's AU:Y (automatable) supplemental marker suggests the overflow could be scripted if an attacker reaches the bootstrap path. Net: this is a real priority to patch for organizations that provision Juniper gear via Secure-ZTP, but the adjacency requirement and bootstrap-only exposure make it a targeted/opportunistic insider-or-local-network risk rather than a mass internet-exploitable issue. No conflicting signals were found; the main gap is the absence of EPSS/KEV/POC data to gauge likelihood of weaponization.

An attacker with a foothold on the same broadcast/management network as a Juniper device undergoing Secure Zero-Touch Provisioning sends a maliciously crafted DHCP SZTP bootstrap message to the phone-home daemon (phcd). The malformed message overflows a stack buffer in phcd and executes attacker-supplied code with root privileges, fully compromising the router or switch during provisioning. No public exploit code is known at time of analysis, and the attacker must be network-adjacent (AV:A) rather than remote.