CVE-2026-102174

Executive Summary

CVE-2026-102174 is a stack-based buffer overflow (CWE-121) in the iked IKE key-management daemon of Juniper Networks Junos OS running on SRX Series firewalls. An authenticated remote-access VPN client can trigger the overflow through the remote-access VPN authentication and JIMS identity-publishing path, achieving code execution with root privileges or causing denial of service. With a CVSS base score of 8.8 (High) and no vendor patch, workaround, or public exploit currently identified, SRX Series deployments offering remote-access VPN services represent an actively exposed attack surface.

Technical Analysis

The vulnerability resides in iked, the Internet Key Exchange daemon responsible for negotiating security associations for IPsec VPN tunnels on Junos OS. Per the NVD description, the flaw is a stack-based buffer overflow (CWE-121) reachable via the remote-access VPN authentication and JIMS (Junos Identity Management Service) identity-publishing path.

Vulnerability class mechanism: A stack-based buffer overflow occurs when a fixed-size stack buffer receives more data than it can hold, and the write is not properly bounds-checked. In the context of a key-management daemon processing remote-access client authentication data, the overflow is triggered by an authenticated remote-access VPN client supplying crafted input during the authentication or identity-publishing exchange. Because the overflowing write targets stack memory, adjacent control data — including a saved instruction pointer — can be overwritten, enabling a control-flow hijack that results in arbitrary code execution in the security context of iked.

Privilege context: The CVSS vector (PR:L) reflects that the attacker must already hold valid remote-access VPN credentials. However, the impact subscores are all High (C:H/I:H/A:H) and Juniper explicitly notes code execution "with root privileges." The iked daemon runs with elevated privileges on the SRX platform; consequently, an authenticated low-privilege VPN user crossing this boundary escalates to full root-level control of the device.

Attack surface: The exposure is the remote-access VPN authentication and JIMS identity-publishing code path within iked. Any SRX Series device configured for remote-access (client-to-site) VPN with JIMS identity publishing enabled is potentially reachable. Because IKE negotiation operates over the network (AV:N) and requires no user interaction (UI:N), an attacker with credentials can reach the vulnerable path directly.

Technical detail limitations: The CNA and NVD descriptions do not disclose the specific function name, buffer identifier, oversize field, or the exact encoding of the malicious input. No byte-level offset, allocation size, or patch diff is available from any tracked source. The analysis above is therefore bounded to the vulnerability class and the named subsystem (iked, remote-access VPN authentication, JIMS identity publishing); no speculative function or parameter names are asserted.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-102174. The attack chain below is inferred strictly from the vulnerability class (stack-based buffer overflow) and the affected component named in the NVD description (iked, remote-access VPN authentication, JIMS identity-publishing path). No specific implementation details are fabricated.

1. Reconnaissance / target identification. The attacker identifies a Juniper SRX Series firewall exposing an IKE/IPsec remote-access VPN endpoint. Reachability of the IKE service is the primary indicator, and JIMS identity publishing must be enabled for the vulnerable path to be exposed. Shodan-style enumeration of Juniper SRX devices with IKE services visible on UDP/500 and UDP/4500 supports targeting.

2. Authentication and trigger. Per the PR:L requirement, the attacker must possess (or have obtained) valid remote-access VPN client credentials. During the authentication / JIMS identity-publishing exchange, the attacker supplies crafted input — a malformed or oversized field — that exceeds the bounds of a fixed-size stack buffer in iked. This is the overflow trigger; the exact field and structure are not disclosed in available intelligence.

3. Payload / execution (class level). The oversized input overwrites adjacent stack memory. At the vulnerability-class level, this permits corruption of control data such as a saved return address, redirecting execution to attacker-controlled data. Juniper's advisory language states the outcome is code execution with root privileges — i.e., the hijacked control flow executes in iked's elevated context. Alternatively, if the overwrite corrupts the stack without a viable control-flow target, the daemon crashes, producing denial of service.

4. Post-exploitation impact. Successful code execution with root privileges on an SRX firewall grants the attacker full control of the security gateway: modification of VPN and firewall policy, interception or decryption of tunneled traffic, establishment of persistence, and use of the device as a pivot point into protected network segments. Denial of service disrupts all VPN-dependent remote connectivity. Given the device's role as a perimeter security control, the blast radius extends to every network segment the SRX protects.

Impact Assessment

• Confidentiality (C:H): Root-level code execution permits reading of all VPN keys, credentials, configuration, and tunneled traffic; the SRX is a central cryptographic trust point.
• Integrity (I:H): An attacker with root can alter firewall rules, VPN configuration, routing, and logging, potentially disabling auditing and enabling persistent access.
• Availability (A:H): Both the buffer-overflow crash path and deliberate post-exploitation actions can render the VPN gateway and protected connectivity unavailable.
• Attack Vector (AV:N): Exploitable over the network via IKE/remote-access VPN services.
• Attack Complexity (AC:L): No special preconditions beyond valid credentials are described.
• Privileges Required (PR:L): Requires an authenticated remote-access VPN client, which is a meaningful barrier — a valid credential pair is necessary.
• User Interaction (UI:N): No user action required for exploitation.
• Scope (S:U): Impact is confined within the vulnerable device's security authority per the vector.

Business impact: Organizations relying on Juniper SRX Series firewalls for remote-access VPN — especially those using JIMS identity publishing — face a privilege-escalation-to-root flaw on a perimeter security device. A compromised SRX undermines the entire trust boundary it enforces, exposing downstream network segments, and the absence of a patch means exposure cannot currently be closed by upgrading. Remote-access VPN infrastructure is high-value and frequently targeted by state-aligned and ransomware-associated intrusion sets, which raises the strategic risk of this finding independent of current exploit-in-the-wild evidence.

Detection Guidance

The rules below are written at the vulnerability-class and component level (stack-based buffer overflow in the iked IKE daemon reachable via remote-access VPN authentication and JIMS identity publishing). They are detection heuristics, not reproductions of any published PoC, and are provided for SOC tuning and environment-specific tuning.

Sigma Rule

title: Potential Stack Buffer Overflow Exploitation in Juniper Junos iked Daemon
id: 7f3c9a12-4b8e-4d2a-9c1f-102174aaaa
status: experimental
description: Detects anomalous crashes or restarts of the iked IKE daemon on Junos SRX, consistent with stack-based buffer overflow exploitation attempts in the remote-access VPN authentication / JIMS identity-publishing path (CVE-2026-102174).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102174
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-102174
logsource:
  product: juniper
  service: junos
  definition: Syslog or audit records from Junos OS on SRX Series
detection:
  selection_daemon:
    keywords:
      - 'iked'
  selection_fault:
    keywords:
      - 'core dump'
      - 'segmentation fault'
      - 'SIGSEGV'
      - 'SIGABRT'
      - 'panic'
      - 'fault'
      - 'restart'
      - 'authd'
      - 'JIMS'
  condition: selection_daemon and selection_fault
falsepositives:
  - Legitimate iked restarts during maintenance or configuration changes
  - Rare hardware/software faults unrelated to exploitation
level: high

YARA Rule

rule CVE_2026_102174_Juniper_iked_Overflow_Artifacts
{
    meta:
        description = "Detects crash/core-dump artifacts referencing the iked daemon and remote-access VPN / JIMS identity-publishing path on Juniper Junos SRX (CVE-2026-102174). Heuristic, class-level detection."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102174"
        date = "2026-01-01"
        severity = "high"

    strings:
        $iked       = "iked" ascii wide nocase
        $jims       = "JIMS" ascii wide nocase
        $ravpn      = "remote-access" ascii wide nocase
        $ipsec      = "IPsec" ascii wide nocase
        $overflow   = "stack" ascii wide nocase
        $crash      = "core dump" ascii wide nocase

    condition:
        uint32be(0) == 0x7f454c46 or   // ELF core/memory dump header
        (2 of ($iked, $jims, $ravpn, $ipsec) and 1 of ($overflow, $crash))
}

Suricata IDS Rule

alert udp any any -> any 500 (msg:"CVE-2026-102174 Possible Juniper Junos iked Stack Buffer Overflow via Remote-Access VPN IKE Exchange"; flow:to_server; content:"|00 00 00 00|"; depth:4; byte_test:4,>,1500,24,relative; threshold: type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-102174; sid:2026102174; rev:1;)

Note: This signature is heuristic only. CVE-2026-102174 targets the post-authentication / JIMS identity-publishing path, which may be carried inside encrypted IKEv2 payloads; the rule targets oversized IKE header-length anomalies indicative of malformed long-payload injection at UDP/500 and should be tuned against baseline traffic. A companion rule on UDP/4500 (NAT-T) is recommended.

Elastic Detection

sequence by host.name with maxspan=2m
  [ process where process.name == "iked" and event.type == "start" ]
  [ process where process.name == "iked" and (event.type == "end" or event.action == "crashed" or event.action == "signal") ]

Correlates an iked process startup with an abnormal iked termination within a two-minute window — a restart-after-crash pattern indicative of a triggered memory-safety fault.

Splunk SPL Query

index=juniper_syslog (sourcetype="juniper:junos" OR sourcetype="juniper:srx")
| search ("iked" AND ("core dump" OR "segmentation fault" OR "SIGSEGV" OR "SIGABRT" OR "fault" OR "restart" OR "panic"))
| stats count min(_time) as first_seen max(_time) as last_seen by host, src_ip
| where count >= 1
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102174,">
  <rule id="1021740" level="12">
    <decoded_as>juniper-junos</decoded_as>
    <match>iked</match>
    <match>core dump|segmentation fault|SIGSEGV|SIGABRT|panic|fault|restart</match>
    <description>CVE-2026-102174: Possible iked daemon crash/restart on Junos SRX - suspected stack-based buffer overflow exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102174,vpn_exploitation,</group>
  </rule>
</group>

Note: Full fidelity requires Junos syslog forwarding to Wazuh with the custom juniper-junos decoder. Tune the <match> expression to the actual Junos syslog strings produced by iked faults in the target environment.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or patched version is identified in any tracked source. The following guidance is precautionary and should be validated against an official Juniper security advisory once published.

1. Immediate mitigations

• Restrict network access to the IKE service (UDP/500 and UDP/4500) to known, trusted remote-access client source ranges using firewall filters on the SRX itself.
• Enforce strong authentication (e.g., certificate-based client authentication) and least-privilege for remote-access VPN users; since PR:L is required, tightening credential issuance reduces the population that can reach the vulnerable path.
• Evaluate whether JIMS identity publishing can be disabled or its exposure reduced on remote-access VPN configurations until a patch is available. Confirm the operational impact before disabling — this must be validated against an official Juniper advisory.
• Enable comprehensive logging and alerting for iked/authd faults and unexpected daemon restarts (see Detection Guidance).
• Monitor for a Juniper security advisory addressing CVE-2026-102174 and subscribe to Juniper SIRT notifications.

2. Patch/upgrade steps

• No patched Junos OS version is currently identified. When Juniper publishes a fix, obtain it from the official Juniper software download portal, validate the advisory's affected-version matrix, and upgrade in a maintenance window with rollback capability.
• Maintain a Junos version inventory across all SRX assets to enable rapid remediation once a fixed release is available.

3. Long-term hardening

• Adopt a hardware-accelerated or dedicated VPN termination architecture where feasible to limit blast radius of a compromised perimeter device.
• Segment management and VPN control planes; restrict where a compromised SRX can reach internally.
• Implement centralized, tamper-evident logging to a remote collector so post-exploitation log tampering is detectable.
• Track CVE-2026-102174 in vulnerability management with a High priority and re-check EPSS (currently unscored by FIRST.org) as telemetry matures.

References

• NVD — CVE-2026-102174: https://nvd.nist.gov/vuln/detail/CVE-2026-102174
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST.org EPSS (currently unscored for this CVE): https://www.first.org/epss/
• Juniper Networks Security Advisories (monitor for advisory addressing CVE-2026-102174): https://supportportal.juniper.net/s/global-search/%40uri

Threat actor / exploit-in-the-wild status: No public PoC, exploit code, or Nuclei template is available, and CVE-2026-102174 is not listed in CISA KEV as of this writing. No specific threat actor campaign is associated with this CVE in available intelligence. Exploit-in-the-wild status should be reassessed as vendor advisory and EPSS data become available.