CVE-2026-102070

Executive Summary

CVE-2026-102070 is a reachable assertion failure (CWE-617) in the Two-Way Active Measurement Protocol (TWAMP) client component of Juniper Networks Junos OS. An unauthenticated, network-based attacker can trigger the assertion by sending a specific crafted TCP packet, causing a disruption of the rmopd service.

The vulnerability is rated CVSS 7.5 (High) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a remotely exploitable, low-complexity availability impact requiring no privileges or user interaction. No public proof-of-concept, Nuclei template, or exploit code has been observed, and the vendor has not published a fix.

Technical Analysis

CVE-2026-102070 is classified under CWE-617: Reachable Assertion. An assertion is a runtime check inserted into software to validate an invariant — an assumption the developer believed must always hold at a given point in execution. When that assumption fails, the assertion triggers and the process terminates (or aborts) to avoid operating in an undefined state. A reachable assertion means the triggering input is reachable from the external attack surface; in this case, from a network-facing TCP listener that handles TWAMP traffic.

Component and attack surface. TWAMP (Two-Way Active Measurement Protocol) is used to measure round-trip and one-way network performance between two endpoints. Junos OS implements a TWAMP client in the rmopd daemon (the Real-Time Management and Operations Protocol daemon). Because TWAMP endpoints exchange control and test traffic over TCP, rmopd maintains a network-listening socket and parses inbound protocol messages. This parser is the exposure point for the vulnerability.

Mechanism. Per the NVD description, a specific TCP packet sent to the TWAMP client causes rmopd to reach an assertion and abort. The precise packet structure, the parser code path, the exact assertion expression, and the underlying Junos release versions are not disclosed in the available CNA/NVD text. Based strictly on the vulnerability class, the failure is most likely one of the following, with no vendor confirmation of which applies:

• A malformed TWAMP control or test message whose field values violate an internal assumption (e.g., a length, state, or sequence invariant checked by an assertion), causing the daemon to abort.
• A protocol-state machine transition that the daemon asserts can never occur but is reachable via a crafted packet outside the expected handshake sequence.

Impact semantics of assertion failures. Because the failure mode is a process abort rather than memory corruption or logic bypass, the primary effect is denial of service — loss of the rmopd service and, transitively, loss of TWAMP measurement and any other function rmopd provides. CVSS reflects this precisely: Integrity and Confidentiality impacts are None (C:N/I:N), while Availability impact is High (A:H). There is no reliable evidence in the provided data of remote code execution, memory disclosure, or authentication bypass; the vulnerability is a robustness/availability defect.

Insufficient technical detail. No CNA title text, affected version table, or workaround guidance was supplied. Claims about exact packet bytes, the assertion line, or the vulnerable Junos releases would be speculative and are intentionally omitted.

Exploitation Scenarios

No public PoC exists; the attack chain below is inferred from the CWE-617 class and the NVD description. It deliberately avoids inventing function names, packet field names, or endpoints not present in the source data.

1. Reconnaissance / target identification. The attacker identifies a reachable Junos OS device with the TWAMP client enabled. This is typically an internet- or WAN-facing device that participates in performance measurement. The TWAMP endpoint is discoverable by probing the TCP port on which the client listens (the specific default port is not given in the source data and must be confirmed against the configured deployment / vendor documentation). Shodan or similar scanners can be used to find exposed Juniper devices for follow-on probing.

2. Triggering the specific flaw class. The attacker establishes the TCP-level connection the TWAMP client expects, then transmits a specific malformed packet that violates an assertion invariant in rmopd's parsing or state-handling logic. Because the CVSS vector is PR:N/AC:L/UI:N, no credentials and no user interaction are required — the crafted packet alone is sufficient. The exact byte layout is not disclosed, so a would-be attacker would need to fuzz the TWAMP client's parser to rediscover the triggering input (a realistic and low-complexity acquisition path given the "specific TCP packet" characterization).

3. Payload / execution method (class level). At the vulnerability-class level, this is a single crafted protocol message — analogous to a malformed-input DoS against a network daemon's message parser. The "payload" is a non-conforming TWAMP message delivered over an established TCP connection; no code injection is involved.

4. Post-exploitation impact. Successful delivery aborts rmopd. The immediate impact is loss of the TWAMP measurement service and any functionality provided by that daemon. Depending on deployment, repeated triggering can keep the service down, and secondary effects (loss of measurement telemetry, monitoring blind spots, possible watchdog restarts) may follow. No lateral movement, credential theft, or configuration change is indicated by the CVSS subscores.

Impact Assessment

Availability (High, A:H). The core impact is denial of service against rmopd. TWAMP is commonly used for SLA monitoring and path-performance measurement; loss of the client degrades observability and can blind network operations teams precisely when they need measurement data most.

Confidentiality (None, C:N) and Integrity (None, I:N). The CVSS subscores indicate no loss of confidentiality or integrity — consistent with an assertion-abort failure mode rather than memory corruption or authentication bypass.

Attack vector and prerequisites. AV:N (remotely reachable over the network), AC:L (low complexity — no special conditions or race required beyond the specific packet), PR:N (no authentication), UI:N (no user action), S:U (impact confined to the vulnerable component).

Blast radius. Scope is limited to the affected component per S:U, but operational blast radius depends on how many functions share rmopd and whether the device serves as a measurement hub. Environments with many Junos devices running the TWAMP client, or service providers relying on TWAMP for customer SLAs, face the broadest operational exposure. Because no affected-version list is published, asset owners must inventory TWAMP-enabled Junos devices manually to bound their risk.

Threat context. No exploit code, no Nuclei template, no CISA KEV listing, and no EPSS score have been published. This lowers near-term mass-exploitation risk but does not eliminate targeted DoS risk, particularly for internet-exposed measurement endpoints.

Detection Guidance

Because no precise packet signature is published, the rules below target (a) TWAMP-related network activity to / from Junos devices, (b) rmopd crash/abort behavior in logs, and (c) service-state anomalies. Rules are intentionally broad and should be tuned to the local environment. No PoC exists to validate a byte-level signature.

Sigma Rule

title: Suspected TWAMP rmopd Assertion DoS on Juniper Junos
id: 6f2a9c1e-1020-70c0-9b3a-000000010207
status: experimental
description: Detects rmopd service disruption patterns consistent with CVE-2026-102070 (reachable assertion in Junos TWAMP client).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102070
author: valtersit.com
date: 2026/01/01
logsource:
  product: juniper
  service: junos
detection:
  selection_rmopd:
    message|contains:
      - 'rmopd'
      - 'TWAMP'
  selection_fault:
    message|contains:
      - 'assert'
      - 'abort'
      - 'core'
      - 'terminated'
      - 'restart'
  condition: selection_rmopd and selection_fault
fields:
  - hostname
  - message
falsepositives:
  - Legitimate daemon restarts, maintenance windows, unrelated core dumps
level: high
tags:
  - attack.t1190
  - cwe.617

YARA Rule

rule CVE_2026_102070_TWAMP_RMOPD_Assertion_Indicator
{
    meta:
        author = "valtersit.com"
        description = "Heuristic indicator for Junos rmopd assert/abort strings linked to TWAMP client DoS (CVE-2026-102070)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102070"
        cve = "CVE-2026-102070"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "rmopd" ascii wide
        $s2 = "TWAMP" ascii wide nocase
        $s3 = "assert" ascii wide nocase
        $s4 = "abort" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or filesize > 0) and
        $s1 and $s2 and ($s3 or $s4)
}

Note: this rule is a heuristic artifact/log indicator, not a memory signature for the exact crash, because the triggering packet and crash string are not publicly known.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-102070 Possible TWAMP rmopd Assertion DoS Attempt (Juniper Junos)"; flow:established,to_server; content:"|00 00|"; depth:2; pcre:"/TWAMP/i"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; reference:cve,2026-102070; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102070; sid:2026102070; rev:1;)

Note: the exact port, message framing, and content bytes for the specific packet are not published, so this rule matches TWAMP-related TCP traffic at volume and should be tuned; a byte-accurate signature cannot be authored without the vendor's packet details.

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where event.category == "process" and process.name == "rmopd" and
      (process.outcome == "crashed" or message : "assert" or message : "abort") ]
  [ any where event.category == "process" and process.name == "rmopd" ]

Companion EQL for log-based detection:

any where
  (message : "rmopd") and (message : "TWAMP") and
  (message : "assert" or message : "abort" or message : "core" or message : "restart")

Splunk SPL Query

index=network OR index=juniper
| search (host=*junos* OR sourcetype=junos* OR sourcetype=junos_syslog)
| search ("rmopd" OR "TWAMP")
| search ("assert" OR "abort" OR "core" OR "terminated" OR "restart")
| stats count min(_time) as first_seen max(_time) as last_seen by host, message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Optional complementary search on Suricata/network telemetry:

index=ids sourcetype=suricata signature="CVE-2026-102070*"
| stats count by src_ip, dest_ip, dest_port
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102070,">
  <rule id="1020700" level="10">
    <decoded_as>syslog</decoded_as>
    <match>rmopd</match>
    <description>CVE-2026-102070: Junos rmopd (TWAMP client) activity detected</description>
  </rule>

  <rule id="1020701" level="12">
    <if_sid>1020700</if_sid>
    <match>assert|abort|core|terminated|restart</match>
    <description>CVE-2026-102070: Junos rmopd assertion/abort - possible TWAMP client DoS</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version table has been published. The steps below are defensive best practices; they are not vendor-confirmed remediations.

1. Immediate mitigations.

• If TWAMP client functionality is not required, disable the TWAMP client on Junos devices and remove inbound access to the relevant listener.
• Restrict network access to the TWAMP control/test port so that only trusted measurement peers can reach the device (management-plane filtering / firewall term policies). The default port is not specified in the source data — confirm it against your configuration before applying ACLs.
• Where measurement is required, decouple exposure: terminate TWAMP on a hardened, isolated measurement host rather than on production routers where possible.
• Monitor rmopd for unexpected restarts/aborts (see Detection Guidance) and correlate with inbound TWAMP traffic to identify abusive sources.

2. Patch / upgrade steps.

• No patch is available from tracked sources. Monitor the Juniper Security Advisories portal (support.juniper.net / kb.juniper.net) and the NVD entry for an official advisory, affected-version list, and fixed release.
• When a fix is released, stage it in a lab, validate that TWAMP/rmopd functionality behaves correctly, then roll out to TWAMP-enabled devices. Prioritize internet- or WAN-exposed endpoints.

3. Long-term hardening.

• Maintain an accurate inventory of Junos devices with the TWAMP client enabled to bound blast radius while no affected-version list exists.
• Apply control-plane and management-plane filtering so performance-measurement daemons are not reachable from untrusted networks.
• Enable remote syslog and core-dump collection to preserve evidence for post-incident analysis and to detect daemon-abort patterns.
• Keep devices on supported Junos release trains and subscribe to vendor advisory feeds for timely patch information.

References

1. National Vulnerability Database — CVE-2026-102070: https://nvd.nist.gov/vuln/detail/CVE-2026-102070
2. MITRE CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html
3. Juniper Networks Security Advisories (vendor advisory portal; no CVE-specific advisory published at time of writing): https://supportportal.juniper.net/s/global-search/%40uri#q=CVE-2026-102070
4. FIRST — EPSS (no score currently published for CVE-2026-102070 at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-102070
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102070 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No exploit code, PoC, Nuclei template, or in-the-wild exploitation evidence was observed for CVE-2026-102070 in any tracked source. No EPSS score is published, and the CVE is not listed in CISA KEV. The absence of a vendor advisory and affected-version data means risk assessment must rely on the CVSS vector (remote, unauthenticated, low-complexity availability impact) and on local exposure inventory of TWAMP-enabled Junos devices.