CVE-2026-102055

Executive Summary

CVE-2026-102055 is a stack-based buffer overflow (CWE-121) in the cfmd process of Juniper Networks Junos OS on MX Series platforms and Junos OS Evolved on PTX Series platforms. An unauthenticated attacker with adjacent-network access can trigger the flaw by sending a specific Connectivity Fault Management (CFM) message to a configured down-MEP when enhanced CFM mode is enabled, achieving arbitrary code execution as root or causing a denial of service. With a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this is a high-severity, zero-authentication, network-adjacent remote code execution vulnerability for which no patch, PoC, or exploit code is currently public.

Technical Analysis

The vulnerability resides in cfmd, the Juniper daemon responsible for Connectivity Fault Management (CFM / IEEE 802.1ag and ITU-T Y.1731). CFM messages are Layer 2 Ethernet OAM frames exchanged between Maintenance End Points (MEPs) and Maintenance Intermediate Points (MIPs). Because these frames are link-local in nature, an attacker does not require routing reachability or authentication — only adjacency to the broadcast domain or interface where the target MEP is configured.

The specific weakness is CWE-121, Stack-based Buffer Overflow. In a stack-based overflow, a fixed-size stack buffer is populated with attacker-controlled data whose length is not validated against the buffer's capacity. When the input exceeds the buffer, adjacent stack memory — including saved registers and the return address — is overwritten. If the attacker can control the overwritten data with sufficient precision, control flow can be redirected to attacker-supplied code or to a ROP-style chain, yielding code execution in the security context of the vulnerable process.

Two contextual preconditions are explicit in the advisory and materially narrow the attack surface:

1. The target must be a configured down-MEP. A down-MEP is the MEP configured to transmit (down) CFM continuity-check or related messages; it is a specific, operator-defined CFM role rather than a default state.
2. Enhanced CFM mode must be enabled. The parsing path that contains the overflow is only exercised in this non-default mode.

These preconditions mean the vulnerable code path is not reachable in a default Junos configuration. Operators who have deployed CFM with enhanced mode for carrier-Ethernet or service-provider OAM monitoring are exposed; operators who have not enabled CFM are not.

Because the crash/hijack occurs inside cfmd, a long-running system daemon on the routing control plane, a successful overflow is unusually dangerous: cfmd executes with elevated privilege, which is why the advisory states arbitrary code can execute as root. The CVSS vector reflects this — Scope is Unchanged (S:U), but Confidentiality, Integrity, and Availability impacts are each rated High.

No public PoC, exploit code, or Nuclei template exists as of this report, and the vendor has not released a patch. Consequently, the precise buffer, the exact CFM message field that overflows, and the required offset are not publicly documented. This report therefore describes the attack at the vulnerability-class level and does not fabricate specific field names, offsets, or function names beyond those stated in the advisory.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class described in the advisory.

1. Reconnaissance / target identification. The attacker positions themselves on the same Layer 2 segment as the target router (adjacent-network, AV:A). They enumerate reachable devices and determine whether CFM is in use — CFM continuity-check frames carry recognizable EtherType/CFM markers and are observable by passive sniffing of OAM traffic. The attacker looks for a device acting as a down-MEP, indicating CFM is configured and, if enhanced mode is active, that the vulnerable parser is reachable.

2. Triggering the flaw. The attacker crafts and sends "a specific CFM Message" to the configured down-MEP. The advisory does not disclose which CFM message type or field is malformed. Mechanistically, the message carries an oversized or malformed field that is copied into a fixed-size stack buffer inside cfmd without a length check, overflowing the buffer. Correctly framing CFM messages requires understanding of 802.1ag/Y.1731 encapsulation, but no authentication or credentials are needed.

3. Payload / execution. In the overflow class, the oversized field overwrites stack memory past the intended buffer, including the saved return address (and potentially other saved pointers). If the attacker controls the values written, they redirect execution to shellcode or a ROP chain. The advisory states the outcome is "execute arbitrary code as root or cause denial of service," confirming both control-flow-hijack and crash outcomes are achievable. No specific offsets or gadget addresses are publicly known.

4. Post-exploitation impact. Root code execution inside cfmd on the routing control plane grants full device compromise: reading/modifying configuration, altering routing and forwarding state, establishing persistence, and pivoting into the operator's management network. Even without reliable code execution, the denial-of-service outcome removes CFM fault monitoring and can destabilize the OAM function — and, depending on Junos failure handling, the daemon restart may cause service interruption.

Impact Assessment

• Confidentiality (C:H): Root-level access exposes the entire device configuration and all traffic flowing through it.
• Integrity (I:H): Full control of a routing platform allows modification of configurations, routes, and forwarded traffic.
• Availability (A:H): The flaw can produce a crash/DoS of cfmd and, via arbitrary code execution, any other availability impact on the platform.
• Scope (S:U): Impact is confined to the vulnerable component/device rather than formally crossing a security authority boundary per CVSS scoring.
• Exploitability: AV:A + AC:L + PR:N means a low-complexity attack with no credentials from an adjacent position — a low bar for anyone on the same L2 segment.
• Blast radius: MX Series (Junos OS) and PTX Series (Junos OS Evolved). In carrier/service-provider and large-enterprise environments these are core/edge platforms; compromise can propagate trust across the operator network.
• Preconditions reduce exposure: Only deployments with a configured down-MEP and enhanced CFM mode enabled are reachable. This limits the at-risk population but not the severity for those affected.
• CVSS 8.8 (High): AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Detection Guidance

Sigma Rule

title: Suspicious CFM (802.1ag/Y.1731) Messages Targeting Down-MEP with Enhanced CFM Mode
id: 7b1c4e2a-9f3d-4a6b-8c1e-2d5f0a9b3c7e
status: experimental
description: Detects anomalous or oversized Connectivity Fault Management frames that may indicate exploitation of CVE-2026-102055 in Juniper cfmd.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102055
author: SOC Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: juniper
detection:
  selection_daemon:
    process|contains: 'cfmd'
  selection_event:
    message|contains:
      - 'CFM'
      - 'MEP'
      - 'buffer overflow'
      - 'stack'
  condition: selection_daemon and selection_event
falsepositives:
  - Legitimate CFM continuity-check traffic
  - Debug-level CFM logging
level: high
tags:
  - attack.t1190
  - cve.2026.102055

YARA Rule

rule CVE_2026_102055_Juniper_cfmd_CFM_Overflow
{
    meta:
        description = "Detects indicators associated with CVE-2026-102055 cfmd CFM message stack overflow on Juniper Junos MX/PTX"
        author = "SOC Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102055"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cfm1 = "cfmd" ascii
        $cfm2 = "Connectivity Fault Management" ascii nocase
        $cfm3 = "Maintenance End Point" ascii nocase
        $cfm4 = "enhanced CFM" ascii nocase

    condition:
        uint32(0) == 0x464C457F and any of ($cfm*)
}

Suricata IDS Rule

alert ethernet any any -> any any (msg:"CVE-2026-102055 Possible CFM Message Triggering Juniper cfmd Stack Overflow"; ethertype:0x8902; content:"|00 00|"; offset:0; depth:2; byte_test:2,>,1500,0,relative; classtype:attempted-admin; reference:cve,2026-102055; sid:2026102055; rev:1;)

Elastic Detection

process where process.name == "cfmd" and
  (message contains "CFM" or message contains "maintenance end point" or
   message contains "buffer overflow" or message contains "stack")

Splunk SPL Query

index=juniper sourcetype=juniper:syslog
(process="cfmd" OR "cfmd" OR "CFM" OR "maintenance end point" OR "enhanced CFM")
("stack" OR "buffer overflow" OR "SIGSEGV" OR "core dump" OR "abort")
| stats count values(message) by host, process
| where count > 0

Wazuh OSSEC Rule

<group name="juniper,cfm,">
  <rule id="2026055" level="12">
    <decoded_as>syslog</decoded_as>
    <match>cfmd</match>
    <match>CFM|maintenance end point|buffer overflow|stack</match>
    <description>CVE-2026-102055: Possible cfmd CFM stack buffer overflow attempt on Juniper MX/PTX</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102055,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no vendor patch exists):

   • Where CFM is not operationally required, disable CFM on the affected down-MEPs and disable enhanced CFM mode to remove the vulnerable code path from reach.
   • Where CFM is required, restrict Layer 2 adjacency to the affected segment: apply port security, 802.1X, MAC limiting, and storm/L2 filter controls to host-facing ports so that unauthorized adjacent hosts cannot inject CFM frames toward the router.
   • Harden management-plane and OAM-plane access (control-plane policing) to rate-limit or drop anomalous CFM frames.
   • Monitor cfmd for abnormal restarts, crashes, or core dumps, which are strong signals of attempted exploitation.
   • Isolate vulnerable platforms as far as practical from untrusted L2 segments; in service-provider terms, ensure customer-edge ports cannot reach provider-edge CFM endpoints.

2. Patch / upgrade steps:

   • No fixed version or advisory reference is available in any tracked source at this time. Monitor the Juniper Security Advisories portal (supportportal.juniper.net / advisories) and subscribe to Juniper SIRT notifications.
   • When a Junos OS / Junos OS Evolved release addressing CVE-2026-102055 is published, schedule an upgrade in the next maintenance window, prioritizing MX and PTX platforms running CFM with enhanced mode.
   • Validate the fixed version against the official advisory rather than relying on third-party sources.

3. Long-term hardening:

   • Enforce strict Layer 2 segmentation between untrusted hosts and routing control-plane interfaces; treat OAM frames as control-plane traffic subject to policing and ACLs.
   • Adopt a default-deny posture for management and OAM protocols — enable only what is strictly required and only on the interfaces where it is required.
   • Integrate monitoring that alerts on control-plane daemon crashes (cfmd, rpd, etc.) as a security indicator, not merely an operational event.
   • Maintain an inventory of platforms running CFM so that, once a patch is available, the exposed population can be located and remediated quickly.

References

• NVD — CVE-2026-102055: https://nvd.nist.gov/vuln/detail/CVE-2026-102055
• MITRE CWE-121 (Stack-based Buffer Overflow): https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Juniper Security Advisories portal: https://supportportal.juniper.net/s/topic/0TO4X0000009Y0mWAC/security-advisories
• IEEE 802.1ag / ITU-T Y.1731 — Connectivity Fault Management (CFM) overview: https://en.wikipedia.org/wiki/IEEE_802.1ag

Exploit-in-the-wild evidence: None observed. CISA KEV: not listed. No public PoC or exploit code available as of this report.