CVE-2026-102175

Executive Summary

CVE-2026-102175 is a heap-based buffer overflow (CWE-122) in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved. It is exploitable by a remote, unauthenticated attacker who can control or intercept the configured SDX/SRC server connection, allowing code execution as root or denial of service via a crafted frame sent over the service-deployment TCP connection. With a CVSS score of 9.8 and no vendor patch currently tracked, the exposure is severe for any Junos deployment that has an SDX/SRC service-deployment connection configured.

Technical Analysis

The vulnerability resides in the sdxd daemon, which handles service deployment operations on Junos OS and Junos OS Evolved. Per the NVD description, the flaw is a heap-based buffer overflow triggered by processing a crafted frame received over the service-deployment TCP connection. The attack surface is the network-facing TCP listener managed by sdxd, specifically the code path that parses inbound frames from an SDX/SRC server.

A heap-based buffer overflow (CWE-122) occurs when the daemon allocates a heap buffer based on one size value and then writes more data into it than was allocated — for example, when an inbound frame declares a length that does not match the actual data copied into the buffer, or when a length field is trusted without validation. Because the vulnerable component is the daemon itself, which processes frames from a peer over a TCP session, the corruption is reachable pre-authentication from the network, provided the attacker can control or intercept the SDX/SRC server connection.

The critical trust assumption is that the SDX/SRC server endpoint is trusted. The NVD description explicitly frames the attacker as one "who can control or intercept the configured SDX/SRC server connection," which means an on-path adversary, a compromised SDX/SRC host, or a host able to spoof/redirect that connection can trigger the overflow. On success, the overflow corrupts heap memory in a process that runs with root privileges, enabling arbitrary code execution as root; on failure, it causes a crash and denial of service.

Insufficient technical detail is available to state the exact function name, buffer allocation site, or frame field names involved — no such identifiers appear in the CVE data, and none should be assumed. The class-level mechanism (untrusted length/data handling in a network frame parser) is the maximum specificity justified by the source data.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms: network reachable, low complexity, no privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. Identify Juniper Junos OS or Junos OS Evolved devices that expose or use service-deployment functionality. The attacker needs visibility into, or control over, the SDX/SRC server connection used by sdxd. This may be achieved by positioning on the network path between the device and its configured SDX/SRC server, by compromising the SDX/SRC server endpoint itself, or by manipulating resolution so the device connects to an attacker-controlled endpoint.

2. Triggering the flaw class. The attacker establishes (or hijacks) the service-deployment TCP connection and transmits a crafted frame. Per the description, the crafted frame is the trigger for the heap-based buffer overflow in sdxd. No specific frame structure or field names can be provided from the available data.

3. Payload / execution method (class level). Heap-based buffer overflows are weaponized by supplying oversized or length-mismatched input that overwrites adjacent heap metadata or function pointers in the root-running process. At the vulnerability-class level, successful exploitation corrupts heap memory in sdxd, which the description states permits execution of code as root. Exact heap layout, allocation primitives, and overwrite targets are not derivable from the provided data.

4. Post-exploitation impact. Code execution occurs with root privileges on the Junos device. That grants full control of the appliance: modification of routing/security configuration, access to traffic traversing the device, persistence, and lateral movement into the management plane. Alternatively, a failed exploit attempt crashes sdxd, producing denial of service of the service-deployment function.

Impact Assessment

CVSS 9.8 (Critical) with subscores Confidentiality:High, Integrity:High, Availability:High and no privileges or user interaction required. The blast radius is any Junos OS or Junos OS Evolved deployment that has an SDX/SRC service-deployment connection configured and reachable. Because exploitation yields root on the device, business impact includes:

• Full compromise of the network device, including routing, firewall, and VPN control planes.
• Potential interception or manipulation of customer/enterprise traffic traversing the device.
• Persistence and use of the device as a pivot into trusted internal networks.
• Denial of service to service-deployment and potentially broader device functions if the daemon crashes.
• Compliance and regulatory exposure where network infrastructure is in scope.

The reliance on controlling/intercepting the SDX/SRC connection constrains mass exploitation but does not reduce severity for targeted operations, insider scenarios, or environments using unauthenticated/plaintext SDX/SRC connectivity.

Detection Guidance

Sigma Rule

title: Suspicious Crafted Frame / sdxd Service-Deployment Connection Anomaly (CVE-2026-102175)
id: 7f9a1c2e-4b3d-4e5f-9a10-2c6d8e7b1f42
status: experimental
description: Detects anomalous or crashing sdxd service-deployment daemon behavior consistent with heap overflow exploitation attempts against Junos OS / Junos OS Evolved (CVE-2026-102175).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102175
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.102175
logsource:
  product: juniper
  service: junos
detection:
  selection_process:
    process.name: 'sdxd'
  selection_crash:
    event.action:
      - 'process_crash'
      - 'core_dump'
      - 'segfault'
    process.name: 'sdxd'
  selection_conn:
    destination.port: 7804
    network.transport: 'tcp'
  condition: (selection_process and selection_crash) or selection_conn
falsepositives:
  - Legitimate SDX/SRC service-deployment operations
  - Administrative maintenance of the SDX/SRC connection
level: high

YARA Rule

rule CVE_2026_102175_sdxd_heap_overflow_artifact
{
    meta:
        description = "Detects strings/artifacts associated with exploitation of the Junos sdxd service-deployment heap buffer overflow (CVE-2026-102175)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102175"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $sdxd = "sdxd" ascii wide nocase
        $svc  = "service-deployment" ascii wide nocase
        $sdx  = "SDX" ascii wide
        $src  = "SRC" ascii wide
        $heap = "heap" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true
        and any of ($sdxd, $svc) and 1 of ($sdx, $src, $heap)
}

Suricata IDS Rule

alert tcp any any -> any 7804 (msg:"CVE-2026-102175 Juniper Junos sdxd service-deployment suspected heap overflow attempt"; flow:established,to_server; dsize:>1500; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-102175; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102175; sid:2026102175; rev:1;)

Note: port 7804 is a commonly referenced Junos service-deployment port; validate against the environment's actual configured SDX/SRC port. Adjust dsize thresholds to the deployment baseline.

Elastic Detection

sequence by host.name with maxspan=2m
  [ process where process.name == "sdxd" and event.action in ("start", "connect") ]
  [ process where process.name == "sdxd" and event.action in ("crash", "segfault", "core_dump", "terminated") ]

process where process.name == "sdxd" and
  (message like~ "*buffer overflow*" or message like~ "*segfault*" or message like~ "*corrupt*")

Splunk SPL Query

index=junos sourcetype=junos:system OR sourcetype=junos:daemon (process="sdxd" OR message="*sdxd*")
| search ("core dump" OR "segfault" OR "crash" OR "buffer overflow" OR "abnormal termination" OR "service-deployment")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, message
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="juniper,junos,cve-2026-102175,">
  <rule id="102175" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">sdxd</field>
    <match>core dump|segfault|crash|buffer overflow|abnormal termination</match>
    <description>CVE-2026-102175: Possible sdxd service-deployment heap buffer overflow exploitation or crash on Junos device</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network reachability to the service-deployment TCP connection handled by sdxd; enforce strict firewall/ACL controls so only the legitimate SDX/SRC server can reach the daemon.
   • Protect the SDX/SRC server endpoint and its connection path: segment the management/service-deployment plane away from untrusted networks to reduce the risk of an on-path or spoofing attacker controlling/intercepting the connection.
   • Where service deployment via SDX/SRC is not required, disable the SDX/SRC server configuration so sdxd does not process external frames.
   • Monitor sdxd for crashes and anomalous restarts as an interim detection signal.

2. Patch / upgrade steps

   • No vendor patch is currently tracked (patch confidence 0/4). Monitor the Juniper Networks security advisories page for an official fix and affected-version list, and apply the vendor-released Junos OS / Junos OS Evolved update as soon as it is available.
   • Until a patch exists, rely on the mitigations above; do not assume any fixed version.

3. Long-term hardening

   • Maintain a software bill of materials and an inventory of devices running the sdxd service-deployment function.
   • Require authenticated and integrity-protected channels for service-deployment communications where supported.
   • Adopt a staged upgrade cadence for Junos OS / Junos OS Evolved to rapidly consume vendor security releases.
   • Continuously monitor CISA KEV and Juniper advisories for status changes (currently CISA KEV: NO).

References

• NVD — CVE-2026-102175: https://nvd.nist.gov/vuln/detail/CVE-2026-102175
• Juniper Networks Security Advisories: https://supportportal.juniper.net/s/global-search/%40uri#sort=relevancy&f:contenttype=[Security%20Advisories]
• CWE-122 (Heap-based Buffer Overflow): https://cwe.mitre.org/data/definitions/122.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available for this CVE. No confirmed exploit-in-the-wild activity or associated threat actor campaign has been identified in the provided data.