CVE-2026-102061

Executive Summary

CVE-2026-102061 is a stack-based buffer overflow (CWE-121) in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved. An adjacent, unauthenticated attacker can send a crafted DHCP SZTP (Secure Zero Touch Provisioning) bootstrap message that overflows a stack buffer and achieves arbitrary code execution as root on the affected device. The vulnerability carries a CVSS 3.1 base score of 8.8 (High) and is currently unpatched, with no public proof-of-concept, no exploit code, and no CISA KEV listing at the time of writing.

Technical Analysis

Junos OS is the network operating system that powers Juniper's routing, switching, and security platforms. The phcd process is the "phone-home daemon," a service used to automate device onboarding and configuration delivery. When Secure Zero Touch Provisioning (Secure-ZTP) is enabled, a device that is not yet fully provisioned uses DHCP and related bootstrap mechanisms to discover its controller and receive signed provisioning instructions over the network.

The vulnerability is a stack-based buffer overflow (CWE-121). This class of defect occurs when a program copies attacker-supplied data into a fixed-size buffer allocated on the call stack without validating that the input length is within bounds. The overwrite can corrupt adjacent stack memory, including saved registers and the return address. When the affected function returns, the corrupted control data can redirect execution to attacker-controlled code.

In this CVE, the overflow is reachable through the phcd daemon via a crafted DHCP SZTP bootstrap message. DHCP is a broadcast-oriented, link-local protocol, meaning the malicious packet must originate from a host on the same Layer 2 segment or broadcast domain as the target device — this is consistent with the CVSS vector specifying AV:A (Adjacent). No credentials or user interaction are required (PR:N / UI:N), so any host able to reach the device's DHCP/bootstrap path on the local segment can attempt exploitation.

Because phcd runs with elevated privileges, a successful overflow yields arbitrary code execution as root, resulting in full compromise of the control plane. The CVSS subscores reflect this: Confidentiality: High, Integrity: High, Availability: High, with Scope: Unchanged (the impact is confined to the vulnerable device component).

The NVD description explicitly notes that only platforms supporting Secure-ZTP are affected. Devices with Secure-ZTP disabled do not expose the vulnerable code path in phcd. No further code-level detail (specific function names, buffer sizes, or message field offsets) is available in the source data, and none is fabricated here.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The attack chain below is therefore inferred strictly from the vulnerability class (stack-based buffer overflow) and the attack surface described in the NVD entry (DHCP SZTP bootstrap handling in phcd).

1. Reconnaissance / target identification. An attacker gains access to the same Layer 2 network segment or broadcast domain as the target Juniper device (for example, via a compromised host in a wiring closet, a rogue device on an access VLAN, or a misconfigured trunk). Because the vector is adjacent (AV:A), physical or logical proximity is a precondition. The attacker identifies candidate devices — typically Juniper platforms in an unprovisioned or onboarding state where Secure-ZTP is enabled and phcd is listening for bootstrap traffic.

2. Triggering the flaw. The attacker sends a crafted DHCP SZTP bootstrap message to the target. The message is malformed in a way that exceeds the bounds of a stack buffer in phcd's message-processing path. Because no authentication is required (PR:N) and no user action is needed (UI:N), the only barrier is network reachability.

3. Payload / execution. The overflow overwrites stack memory. Depending on the exact layout, the attacker can corrupt saved control data (such as a return address) so that when the vulnerable function returns, execution is redirected. Since phcd runs as a privileged process, the attacker achieves arbitrary code execution as root without needing to escalate privileges afterward.

4. Post-exploitation impact. With root on the device, the attacker controls the routing/switching control plane. This enables traffic interception and manipulation, configuration changes, persistence, lateral movement into the internal network, and potential disruption of availability. Given the "Unchanged" scope, impact is confined to the device itself, but a root-level network device compromise has broad downstream consequences for everything transiting it.

Caveat: The exact byte pattern, offset, and delivery framing are not disclosed in available data. Any specific buffer size or field name would be speculation and is deliberately omitted.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High), computed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

• Attack Vector (Adjacent): the attacker must be on the same link-local segment. This narrows the remote attack surface but remains achievable by anyone with network access to the segment — including insider threats, compromised endpoints, or attackers who have pivoted from another foothold.
• Attack Complexity (Low): no special conditions or race windows are described.
• Privileges Required (None): unauthenticated.
• User Interaction (None): fully automated trigger.
• Confidentiality / Integrity / Availability (High each): root code execution on a network device undermines all three.

Blast radius. Only platforms supporting Secure-ZTP are affected, which limits the population. However, for affected devices, a compromise is severe: a routing or security platform executes as root, meaning the attacker can read sensitive configuration, alter routing and ACLs, deploy persistence, and use the device as a pivot into protected network segments. Devices in provisioning/onboarding states are the most exposed because they are actively accepting bootstrap traffic.

Business impact includes potential outage of a core network element, exposure of credentials and configuration secrets stored on the device, and loss of trust in network segmentation controls that the device enforces.

Detection Guidance

Detection here is challenging because the trigger is a malformed DHCP-based bootstrap message rather than HTTP or a conventional exploit payload. The detection content below targets anomalous DHCP/bootstrap traffic toward Juniper devices, process crashes in phcd, and post-exploitation indicators. Rules are written against the vulnerability class and the described attack surface; tune thresholds and interface names to your environment. No public IOCs exist for this CVE.

Sigma Rule

title: Potential CVE-2026-102061 Junos phcd Stack Buffer Overflow via DHCP SZTP
id: 7f3a1c92-0b6e-4d21-9c47-8a2f5e60d1aa
status: experimental
description: Detects crash/fault events for the Junos phone-home daemon (phcd) consistent with a malformed DHCP SZTP bootstrap message, potentially indicative of CVE-2026-102061.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102061
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_proc:
    - message|contains: 'phcd'
    - process|contains: 'phcd'
  selection_fault:
    - message|contains: 'core dump'
    - message|contains: 'segmentation fault'
    - message|contains: 'signal 11'
    - message|contains: 'panic'
    - message|contains: 'buffer overflow'
  condition: selection_proc and selection_fault
falsepositives:
  - Legitimate phcd restarts during provisioning
  - Unrelated software faults in phcd
level: high
tags:
  - attack.t1190
  - cve.2026.102061

YARA Rule

rule CVE_2026_102061_Junos_phcd_DHCP_SZTP
{
    meta:
        description = "Heuristic detection of oversized/crafted DHCP SZTP bootstrap payloads targeting Juniper phcd (CVE-2026-102061)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102061"
        cve = "CVE-2026-102061"
        tlp = "WHITE"

    strings:
        // DHCP magic cookie present in DHCP/BOOTP options payload
        $dhcp_magic = { 63 82 53 63 }
        // SZTP-related indicators observed in bootstrap traffic (case-insensitive)
        $sztp1 = "sztp" nocase
        $sztp2 = "secure-ztp" nocase
        $sztp3 = "bootstrap" nocase

    condition:
        $dhcp_magic at 0x00 and any of ($sztp*)
}

Note: YARA is a file/binary scanner; this rule is intended for offline analysis of captured DHCP/BOOTP payload artifacts rather than live inline network inspection, and it is heuristic only.

Suricata IDS Rule

alert udp any 67 -> any 68 (msg:"CVE-2026-102061 Possible Junos phcd DHCP SZTP Bootstrap Overflow Attempt"; flow:to_client; content:"|63 82 53 63|"; content:"sztp"; nocase; byte_test:2,>,1024,0,relative; sid:2026102061; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-102061, affected_product Juniper_Junos; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102061;)

Note: The byte_test threshold is a tunable heuristic placeholder for detecting abnormally large DHCP option content; validate against normal provisioning traffic before enabling in production. Suricata provides partial coverage at best for link-local bootstrap abuse.

Elastic Detection

sequence by host.name with maxspan=5s
  [process where process.name == "phcd"]
  [process where event.category == "process" and
     (process.name == "phcd" or process.parent.name == "phcd") and
     (event.action == "signal" or process.exit_code != 0)]

Note: This EQL is effective only where host/process telemetry from Junos devices is forwarded (e.g., via syslog-to-Elastic pipelines). Where that telemetry is unavailable, monitor for config-management sessions or phcd restart events instead.

Splunk SPL Query

index=network sourcetype=junos:syslog OR sourcetype=dhcpd
("phcd" OR "SZTP" OR "secure-ztp" OR "core dump" OR "segmentation fault" OR "signal 11")
| eval sev=case(
    match(_raw,"(?i)(core dump|segmentation fault|signal 11)"),"CRITICAL",
    match(_raw,"(?i)(szpt|secure-ztp|bootstrap)"),"SUSPICIOUS",
    true(),"INFO")
| stats count min(_time) as first_seen max(_time) as last_seen values(host) as hosts by sev
| where sev != "INFO"
| sort - count

Alternative — investigate DHCP option 60/43 patterns:

index=network sourcetype=dhcp*
| rex field=_raw "(?i)vendor[- ]?class[- ]?id[=:]\s*(?<vcid>.+)"
| where match(vcid,"(?i)junos|juniper|sztp")
| stats count by src, dest, vcid
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,phcd,">
  <rule id="100661" level="12">
    <decoded_as>syslog</decoded_as>
    <program_name>phcd</program_name>
    <regex>(?i)(core dump|segmentation fault|signal 11|buffer overflow|panic)</regex>
    <description>CVE-2026-102061: Possible Junos phcd stack buffer overflow / crash event</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102061,</group>
  </rule>

  <rule id="100662" level="10">
    <decoded_as>syslog</decoded_as>
    <regex>(?i)(sztp|secure-ztp|dhcp.?bootstrap)</regex>
    <description>CVE-2026-102061: Anomalous SZTP/DHCP bootstrap activity observed</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102061,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is present in the intelligence data. The guidance below is defensive and generic; treat all items as interim hardening until Juniper publishes an advisory.

1) Immediate mitigations

• Disable Secure-ZTP where it is not operationally required. Per the NVD description, only platforms supporting Secure-ZTP are affected. Disabling the feature removes exposure to this code path. Validate that you can still satisfy any provisioning requirements through alternate, trusted channels.
• Restrict Layer 2 adjacency to provisioning-capable devices. Because the attack vector is adjacent (AV:A), segment device-onboarding networks tightly. Apply port security, DHCP snooping, and dynamic ARP inspection at the access layer to prevent rogue hosts from reaching unprovisioned equipment.
• Complete provisioning promptly. Devices left in an onboarding state accept bootstrap traffic; minimizing the onboarding window reduces the exposure period.
• Watch for and investigate phcd faults. A crash or restart of phcd may indicate an attempted exploitation; capture core files and packet traces if a device exhibits unexpected daemon restarts.

2) Patch / upgrade steps

• Monitor Juniper's security advisory channels and the NVD entry for CVE-2026-102061 for a fixed release. No fix exists at present.
• Once a patched Junos OS / Junos OS Evolved release is published, plan upgrades for all Secure-ZTP-capable platforms, prioritizing internet-adjacent and onboarding-state devices.
• Validate the fix by confirming the applicable advisory and tested release; do not rely on unverified third-party patch claims.

3) Long-term hardening

• Maintain a hardware/software inventory that flags every platform with Secure-ZTP enabled so exposure can be assessed immediately when advisories drop.
• Adopt a disciplined patch cadence for network operating systems and subscribe to vendor PSIRT notifications.
• Enforce least-privilege and out-of-band management; treat all control-plane daemons as high-value attack surface.
• Deploy the detection content above and review anomalous DHCP/bootstrap traffic as part of normal SOC triage.
• Consider defense-in-depth controls (encrypted management, strict ACLs, monitoring) so that a single compromised segment cannot reach provisioning interfaces.

References

1. NVD — CVE-2026-102061: https://nvd.nist.gov/vuln/detail/CVE-2026-102061
2. Juniper Networks Security Advisories (vendor PSIRT portal — consult for the specific advisory once published): https://supportportal.juniper.net/s/global-search/%40uri#q=security%20advisories
3. CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
4. CISA Known Exploited Vulnerabilities Catalog (verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (no score available at time of writing): https://www.first.org/epss/

Threat actor / exploit-in-the-wild evidence: None. This CVE is not listed in CISA KEV, no public PoC, exploit code, or Nuclei template has been observed, and no threat actor campaigns are associated with it in the available data. EPSS has not yet assigned a score. The absence of observed exploitation does not reduce severity — an unpatched, unauthenticated root code-execution flaw in network infrastructure warrants proactive mitigation and monitoring.