EUVD-2026-101438
GHSA-g884-53ph-r9cm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain ICCP-peer adjacency on Fusion fabric
-
ExploitSend crafted dot1x synchronization message
-
ExecutionOverflow stack buffer in dot1x daemon
-
ImpactCrash daemon or execute code as root
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is limited to Junos OS devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology - a specific, non-default deployment mode. The attacker must be network-adjacent (AV:A) and acting as the configured ICCP peer, meaning they must hold a trusted position on the ICCP control fabric rather than arbitrary remote access. Devices not using Junos Fusion, or using it without dot1x sync, are not exposed; this topology and trust requirement is the primary factor limiting real-world exploitability despite PR:N. |
| Impact | This is a genuinely serious flaw in affected deployments but a narrow one in practice. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H, score 8.7 High) indicates an adjacent, low-complexity attack needing no privileges or user interaction, with high impact to confidentiality, integrity and availability - consistent with a stack-based buffer overflow (CWE-121) in a root-privileged daemon that can yield DoS and potentially root code execution. However, AV:A (not AV:N) plus the description's requirement that the attacker be 'the configured ICCP peer' substantially constrains reachability: exploitation presupposes a privileged network trust position within the Fusion/ICCP fabric, not arbitrary remote access. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world exploitation signal is therefore absent despite the high CVSS. The CVSS marks PR:N, meaning the vector treats the ICCP-peer position as a network-adjacency precondition rather than an authentication credential - defenders should note the 'configured ICCP peer' requirement is effectively a trust/positioning limiter even though CVSS scores it as unauthenticated. Net: prioritize patching on devices actually running Junos Fusion Aggregation with dot1x synchronization, but the restrictive preconditions make this far lower real-world risk than an 8.7 network-facing flaw would suggest for the general Junos install base. |
| Exploit ScenarioDerived | An attacker positioned on the ICCP control link and impersonating or acting as the configured ICCP peer sends crafted dot1x synchronization data to a Junos Fusion Aggregation Device. The malformed input overflows a stack buffer in the root-privileged dot1x daemon, crashing it to cause denial of service and potentially achieving arbitrary code execution as root. No public exploit code was identified at time of analysis; exploitation requires adjacency and the vulnerable Fusion/dot1x-sync configuration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Earlier versions of this analysis (1)
A stack-based buffer overflow in the dot1x daemon of Juniper Networks Junos OS can be triggered on devices operating as Junos Fusion Aggregation Devices, allowing an adjacent attacker who occupies the configured ICCP peer role to crash the daemon (denial of service) and potentially execute code as root. The flaw is rated CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no privileges or user interaction are required per the vector, but the attack surface is narrow: it requires a Junos Fusion aggregation deployment with dot1x synchronization explicitly enabled for the Fusion satellite topology and an attacker positioned on the inter-chassis link acting as the trusted ICCP peer. No public exploit has been identified at time of analysis, and this is a credible high-severity issue rather than a broad emergency - devices not using Junos Fusion, or using Fusion without dot1x synchronization, are not affected.
RemediationAI
Juniper has released vendor fixes; upgrade to 25.4R1-S3, 24.2R2-S5.5, 24.4R2-S5, 23.4R2-S8.13, 23.2R2-S7.7, 25.2R2-S2 or 26.2R1-S2 (or a later maintenance release on the matching train), selecting the branch that corresponds to your deployment, and consult JSA112188 at https://supportportal.juniper.net/JSA112188 for the definitive per-platform guidance. Where the fixed release cannot be applied immediately, the most effective compensating control is to disable dot1x synchronization on the Junos Fusion Aggregation Device for the satellite topology, because the overflow is only reachable while that synchronization is active - the trade-off is that 802.1X state on the Fusion satellites must then be managed locally or through another mechanism. Because exploitation requires the attacker to be the configured ICCP peer, restricting and auditing ICCP peer definitions so that only genuinely trusted aggregation devices can peer reduces the chance of an attacker reaching the vulnerable code path; this does not repair the underlying memory-safety bug and only helps against adversaries who are not already positioned on the control fabric. Installing the fixed Junos OS release remains the only complete remediation, and since no public exploit code or confirmed active exploitation was identified at the time of analysis, patching can be prioritized using normal risk-based processes for the specific Fusion aggregation deployments that meet the preconditions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Junos Fusion collapses a large number of access switches (satellites) under a single Junos OS aggregation device, and the aggregation device exchanges control-plane state with its peers over ICCP (Inter-Chassis Control Protocol). The dot1x daemon implements IEEE 802.1X authentication handling, including the synchronization of dot1x state toward Fusion satellites. The defect is a textbook CWE-121 stack-based buffer overflow: attacker-influenced data received from the ICCP peer is written into a fixed-size stack buffer without adequate bounds validation, so a peer that supplies oversized or malformed input can overwrite adjacent stack memory. Because the dot1x daemon executes with elevated privileges, corruption of that buffer can terminate the process (denial of service) and, in the worst case, be engineered into arbitrary code execution as root on the aggregation device. The attack surface is deliberately constrained: the device must occupy the Junos Fusion Aggregation Device role and dot1x synchronization must be enabled for the required satellite topology, so only that specific, non-default deployment configuration is reachable rather than all Junos OS installations. The affected CPE is cpe:2.3:a:juniper_networks:junos_os:*, narrowed by the release-train ranges published in the vendor advisory.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L
Adjacent ICCP-fabric reach (AV:A) with low complexity and no credential (PR:N per vendor positioning); potential root code execution in the dot1x daemon gives high C/I/A within one authority (S:U).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is triggered when dot1x synchronization is enabled for the required Fusion satellite topology.
Executive ViewAI
Juniper Junos OS devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled are exposed to a high-severity stack buffer overflow that could allow a network-adjacent attacker acting as a trusted ICCP peer to crash the dot1x daemon and potentially execute code as root. Only organizations with this specific Junos Fusion topology and dot1x sync enabled are affected, but for those, a successful exploit could disrupt network operations and compromise sensitive data. Leadership should prioritize identifying and patching affected devices because they are likely core network infrastructure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB