CVE-2026-102059

Executive Summary

CVE-2026-102059 is a critical OS command injection vulnerability (CWE-78) in the phone-home client daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved, affecting EX Series switches, SRX Series security gateways, and QFX Series switches. The flaw allows an adjacent, unauthenticated attacker to execute arbitrary commands with root privileges by operating a rogue DHCP server on the same Layer 2 segment. With a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this represents a high-severity, high-impact risk for any network infrastructure where an attacker can reach the management or access VLANs and influence DHCP responses.

Technical Analysis

The vulnerability resides in the phone-home daemon (phcd), a Junos component historically used to communicate with Juniper support/telemetry infrastructure. The core flaw is an Improper Neutralization of Special Elements used in an OS Command (CWE-78). In this class of vulnerability, untrusted input is passed into a command interpreter without adequate escaping or validation, allowing an attacker to inject shell metacharacters (e.g., ;, |, $(...), backticks) or embedded command sequences that are then executed by the underlying OS.

The attack surface here is DHCP. The device, through phcd, processes data received from a DHCP server. Because the daemon does not properly neutralize special elements within that data before using it in an OS command context, a malicious DHCP server can return crafted response fields (e.g., options, hostname, domain name, or other DHCP attributes) that are interpreted by the shell. The precise fields and the exact command construction are not disclosed in the available NVD description, so the specific parameter names, parsing routines, and code paths cannot be stated with confidence here. What is technically certain from the description:

• The vulnerable component is phcd (the phone-home daemon).
• The injection is reachable via DHCP interaction — i.e., the device acts as a DHCP client and consumes attacker-controlled data.
• Successful exploitation yields command execution with root privileges.
• No authentication is required from the attacker; proximity (adjacency on the same broadcast domain / L2 segment) is the only precondition, reflected by the AV:A (Adjacent) metric.

Because phcd is typically privileged (root) to perform system-level phone-home and telemetry operations, any injection into its command handling inherits root context. This elevates a network-adjacent position (e.g., an attacker on an access port, a compromised host on the same VLAN, or an unauthorized device plugged into the switch) to full device compromise.

CWE-78 is a long-standing, well-understood weakness. The canonical root cause is the use of shell invocation to process untrusted strings rather than using parameterized/structured system calls. The CVSS vector confirms: no privileges required (PR:N), no user interaction (UI:N), low attack complexity (AC:L), and high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The only limiting factor is the adjacent attack vector, which keeps the base score at 8.8 rather than the 9.8+ range of a remote network-reachable variant.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-102059, so the following chain is inferred from the vulnerability class (OS command injection) and the facts stated in the NVD description. It does not rely on any undisclosed function names, endpoints, or parameters.

1. Reconnaissance and target identification. The attacker must first determine that a target Juniper device (EX, SRX, or QFX Series running Junos OS / Junos OS Evolved) relies on DHCP and that phcd is active and processing DHCP-provided data. This requires an adjacent network position — for example, a compromised endpoint on the same access VLAN, a malicious device inserted into an unused switch port, or an attacker in a shared L2 segment. The attacker maps the segment and identifies a DHCP-dependent device.

2. Triggering the flaw. The attacker stands up a rogue (unauthorized) DHCP server on the segment. When the Juniper device sends DHCP requests (e.g., on boot, interface flap, or lease renewal), the rogue server responds. Because the device's phcd processes DHCP-derived data and fails to neutralize special shell elements within that data (CWE-78), the crafted response drives the injection. The attacker controls the malicious DHCP payload; the exact field(s) abused are not disclosed, but the mechanism is command injection through unneutralized special elements in a DHCP-sourced value.

3. Payload / execution. The malicious DHCP response carries embedded shell metacharacters or command sequences. When phcd incorporates the untrusted value into an OS command, the interpreter executes the injected commands. Because phcd runs with root privileges, the injected commands execute as root. Execution is automatic upon the device processing the rogue DHCP response; there is no user prompt (UI:N) and no valid credentials are needed (PR:N).

4. Post-exploitation. With root command execution, the attacker can fully compromise the device: exfiltrate configurations and secrets, modify routing/firewall policy, establish persistence, pivot deeper into the network, or disable/deny service. The C:H/I:H/A:H subscores indicate a total loss of confidentiality, integrity, and availability of the affected device. Given EX/SRX/QFX roles as network distribution, security enforcement, and aggregation points, successful exploitation can cascade across the environment.

Note: Any claim of specific command syntax, abused DHCP option numbers, or exact injection strings would be speculative and is deliberately omitted.

Impact Assessment

A CVSS v3.1 base score of 8.8 places CVE-2026-102059 in the High severity band and — because it is currently UNPATCHED with no public exploit — in the "act now on mitigations" category. Subscore analysis:

• Attack Vector (Adjacent, AV:A): The attacker must be on the same L2 segment or otherwise able to deliver DHCP responses to the target. This is a realistic condition in most enterprise campus and branch networks.
• Attack Complexity (Low, AC:L): No specialized conditions or race windows are implied; a rogue DHCP server is straightforward to deploy.
• Privileges Required (None, PR:N): No authentication is needed — the device consumes DHCP data without crediting the source.
• User Interaction (None, UI:N): Exploitation is automatic when the crafted response is processed.
• Scope (Unchanged, S:U): Impact is confined to the vulnerable device's security authority.
• Confidentiality/Integrity/Availability (High/High/High): Root-level code execution on a network device yields complete compromise.

Business impact. Juniper EX, SRX, and QFX platforms are widely deployed as campus access/distribution switches, data-center leaf/spine, and perimeter security gateways. Root compromise of these devices can enable:

• Traffic interception and redirection (MITM), undermining segmentation and zero-trust assumptions.
• Security control bypass, especially for SRX Series acting as firewalls/VPN endpoints — where compromise can expose internal networks protected by the device.
• Persistent foothold for lateral movement, since network infrastructure holds credentials, routing adjacencies, and management-plane access.
• Denial of service to critical network segments.

Blast radius. Because the device is a control point rather than an endpoint, a single successful exploitation can propagate trust and visibility failures across everything transiting or governed by the affected device. Environments with flat or insufficiently segmented L2 domains are at highest risk.

Detection Guidance

The following rules are behavioral detections for OS command injection reachable via rogue DHCP interaction. Because the exact exploited DHCP field and injected syntax are undisclosed, rules target generic indicators: unexpected shell metacharacters in DHCP-derived processes, anomalous phcd child process execution, and rogue/unauthorized DHCP servers on the segment.

Sigma Rule

title: Suspicious OS Command Injection Activity in Juniper phcd (CVE-2026-102059)
id: 7b3c9e2a-4f18-4d6b-9a10-cve2026102059
status: experimental
description: Detects anomalous child process execution or shell metacharacter activity associated with the Junos phone-home daemon (phcd), potentially resulting from a rogue DHCP server delivering injected input.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102059
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: juniper
detection:
  selection_parent:
    ParentImage|endswith:
      - '/phcd'
      - 'phcd'
  selection_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
      - 'sh'
      - 'bash'
  selection_metachars:
    CommandLine|contains:
      - ';'
      - '|'
      - '`'
      - '$('
      - '&&'
  condition: selection_parent and (selection_shell or selection_metachars)
falsepositives:
  - Legitimate maintenance or telemetry scripts invoking shell via phcd
level: high
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.102059

YARA Rule

rule CVE_2026_102059_Junos_phcd_Command_Injection
{
    meta:
        description = "Detects suspicious shell metacharacter patterns associated with OS command injection delivered to Junos phcd via rogue DHCP (CVE-2026-102059)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102059"
        severity = "high"

    strings:
        $phc = "phcd" ascii wide nocase
        $meta1 = ";" ascii
        $meta2 = "|" ascii
        $meta3 = "$(" ascii
        $meta4 = "`" ascii
        $cmd1 = "/bin/sh" ascii
        $cmd2 = "curl " ascii nocase
        $cmd3 = "wget " ascii nocase
        $cmd4 = "chmod " ascii nocase

    condition:
        $phc and 2 of ($meta*) and 1 of ($cmd*)
}

Suricata IDS Rule

alert udp any 67 -> any 68 (msg:"CVE-2026-102059 Possible Juniper phcd OS Command Injection via Rogue DHCP"; flow:stateless; content:"|63 82 53 63|"; content:";"; content:"/bin/sh"; nocase; classtype:attempted-admin; reference:cve,2026-102059; sid:2026102059; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "phcd" and
  (process.name in ("sh", "bash", "busybox") or
   process.args like~ ("*;*", "*|*", "*$(*", "*`*"))

Splunk SPL Query

index=juniper sourcetype=junos:system OR sourcetype=junos:process
(process_name="phcd" OR parent_process="phcd" OR command_line="*phcd*")
| eval suspicious=if(match(command_line,"(;|\\||\\$\\(|`|&&)"),1,0)
| where suspicious=1 OR process_name IN ("sh","bash","busybox")
| table _time host process_name parent_process command_line user
| sort - _time

Wazuh OSSEC Rule

<group name="juniper,junos,">
  <rule id="2026102" level="12">
    <decoded_as>json</decoded_as>
    <field name="parent_process">phcd</field>
    <regex field="command_line">(;|\||\$\(|`|&amp;&amp;)</regex>
    <description>CVE-2026-102059: Suspicious shell metacharacter execution under Junos phcd (possible OS command injection via rogue DHCP)</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
  <rule id="2026103" level="10">
    <decoded_as>json</decoded_as>
    <field name="parent_process">phcd</field>
    <field name="process_name">sh|bash|busybox</field>
    <description>CVE-2026-102059: phcd spawned a shell interpreter - potential command injection</description>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No patch evidence is available from any tracked source, and the NVD record does not provide fixed version numbers. The following guidance is therefore mitigation-first.

1. Immediate mitigations (compensating controls):

   • Implement DHCP snooping on all access/distribution switch ports. DHCP snooping blocks DHCP server responses on untrusted ports, directly neutralizing the rogue-DHCP delivery vector for this flaw.
   • Rate-limit and filter DHCP on untrusted edge ports; only designated trusted ports should be permitted to serve DHCP.
   • Enforce L2 segmentation / private VLANs and restrict which hosts can coexist on segments with Juniper management-plane devices.
   • Disable unused switch ports and enable port security / 802.1X to prevent unauthorized device insertion (which would grant the required adjacency).
   • Restrict management-plane reachability and monitor for unauthorized DHCP servers on the network.
   • If the phone-home functionality is not operationally required, consider disabling or restricting phcd where Junos configuration options permit; validate against Juniper documentation before changing daemon state.

2. Patch / upgrade steps:

   • Monitor the Juniper Networks security advisories page and the NVD entry for CVE-2026-102059. No fixed release is identified yet.
   • As soon as Juniper publishes an advisory with fixed Junos OS / Junos OS Evolved versions for EX, SRX, and QFX Series, apply the recommended upgrade on an accelerated schedule.
   • Establish a process to track vendor advisory and CVE status continuously, since this is currently unpatched.

3. Long-term hardening:

   • Adopt a network access control (NAC) posture requiring authentication before any host joins a segment with infrastructure devices.
   • Apply least-privilege and defense-in-depth to device daemons; where possible, avoid running network-facing parsing daemons with root privileges (vendor-side fix expected, but relevant to architecture reviews).
   • Deploy continuous DHCP-snooping and rogue-server monitoring across all L2 domains.
   • Maintain configuration backups and integrity monitoring so that root-level compromise can be detected and the device can be rebuilt from a known-good state.
   • Integrate the detection rules above into SIEM/SOC pipelines to catch exploitation attempts while a patch is pending.

References

1. NVD — CVE-2026-102059: https://nvd.nist.gov/vuln/detail/CVE-2026-102059
2. CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
3. Juniper Networks Security Advisories (check for the corresponding advisory once published): https://supportportal.juniper.net/s/global-search/%40uri
4. MITRE ATT&CK — T1059 Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
5. CISA Known Exploited Vulnerabilities Catalog (verify listing status; CVE-2026-102059 is not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or known in-the-wild campaign has been identified for CVE-2026-102059 at the time of writing. EPSS has not yet scored this CVE.