CVE-2026-102177

Executive Summary

CVE-2026-102177 is an out-of-bounds write vulnerability (CWE-787) in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. It is exploitable by an adjacent, unauthenticated attacker when IS-IS link protection and backup-selection features are configured, and results in a denial of service condition. The vulnerability carries a CVSS 3.1 base score of 7.6 (High), reflecting a high availability impact with low confidentiality and integrity impact, and no public proof-of-concept, exploit code, or vendor patch is currently available.

Technical Analysis

The vulnerability resides in the routing protocol daemon (rpd), the core process responsible for maintaining routing state and speaking routing protocols — including IS-IS (Intermediate System to Intermediate System) — on Juniper Networks Junos OS and Junos OS Evolved platforms. The flaw is classified as CWE-787: Out-of-bounds Write, meaning that the software writes data past the end (or before the beginning) of an allocated memory buffer. The NVD description explicitly ties exploitability to two specific IS-IS configuration features: IS-IS link protection and backup-selection. When these features are enabled, the rpd process handles IS-IS topology information in a way that permits a crafted input to induce a memory write outside intended buffer boundaries.

The attack vector is adjacent (AV:A), requires low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). This indicates that an attacker located on the same Layer 2/Layer 3 adjacent network segment — for example, a directly connected router, switch, or a host able to emit IS-IS protocol PDUs — can trigger the flaw without authenticating to the device. Because IS-IS is a link-state routing protocol normally exchanged between directly connected routing devices, adjacency is a natural precondition for reaching the vulnerable code path: an attacker who can form or inject into an IS-IS adjacency can deliver the malformed protocol data that drives the out-of-bounds write.

The consequences, per the CVSS subscores, are asymmetric: availability impact is High (A:H), while confidentiality and integrity are Low (C:L/I:L). This is characteristic of a memory-safety bug in a daemon where the primary observable effect is a crash or restart of rpd — disrupting routing and potentially dropping traffic — rather than demonstrable remote code execution. Because rpd underpins routing on the device, a crash of that daemon degrades or halts control-plane routing operations, which is why the availability subscore dominates.

No function names, source file paths, or specific memory-buffer identifiers are provided in the available NVD/CNA data. Per the reporting constraints for this data set, the specific internal code locations are not disclosed and should not be inferred. The precise IS-IS PDU type, TLV, or field that triggers the over-write is likewise not stated in the source data; the description only establishes that the condition is reachable when IS-IS link protection and backup-selection are configured. Any finer description of which TLV is malformed would be speculative and is intentionally omitted.

What can be said reliably from the vulnerability class: out-of-bounds writes in network protocol parsers/builder routines typically arise when a length, count, or type field supplied over the wire is trusted and used to index or size a buffer without sufficient bounds checking. In an IS-IS context, that buffer would be associated with topology/link state processing, consistent with the fact that link protection and backup-selection configuration is the enabling condition. The specific mechanism in this CVE cannot be confirmed from the provided data.

Exploitation Scenarios

Because there is no public PoC, no exploit code, and no Nuclei template for CVE-2026-102177, the attack chain below is inferred strictly from the vulnerability class (CWE-787) and the deliberately limited facts in the NVD description. It does not assert specific function names, PDU fields, or code paths that are not stated in the source data.

1. Reconnaissance / target identification. The attacker must first identify a Juniper device running Junos OS or Junos OS Evolved on which IS-IS is deployed with link protection and backup-selection configured. This is an architectural prerequisite, not a discovered parameter: the vulnerability is only reachable when those two features are active. The attacker must also establish or achieve network adjacency (the CVSS AV:A vector), since IS-IS data is exchanged between adjacent routing devices. No authentication is required per the CVSS PR:N metric.

2. Triggering the flaw class. With adjacency established, the attacker sends IS-IS protocol data (a crafted IS-IS PDU) into the adjacency. The out-of-bounds write (CWE-787) is reached when rpd processes that data in the context of the link-protection/backup-selection logic. The exact malformed element that overflows the buffer is not specified in available data; at the vulnerability-class level, this corresponds to supplying a crafted length/count/type value that the daemon fails to bounds-check before writing into a fixed-size destination buffer.

3. Payload / execution method. At the class level, the "payload" is a malformed network protocol message delivered to the routing daemon — i.e., a network vector, not host-based. There is no evidence of a multi-stage shellcode payload; the demonstrated (and CVSS-implied) outcome is a memory-safety fault in rpd. No specific packet crafting details can be given without the vulnerable code identifier.

4. Post-exploitation impact. The direct impact is a denial of service: the out-of-bounds write corrupts rpd memory, causing the daemon to malfunction or crash (A:H). Because rpd controls routing, this can interrupt routing services and degrade or drop traffic transiting the affected device. The Low confidentiality and integrity subscores suggest the attacker might, in some circumstances, read or influence limited adjacent memory, but the dominant, reliable effect is availability loss. There is no evidence in the data that this leads to arbitrary code execution.

Per reporting rules: No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The business impact centers on routing availability. Affected systems are Juniper Networks devices running Junos OS and Junos OS Evolved with IS-IS link protection and backup-selection enabled. An adjacent, unauthenticated attacker can induce a denial of service in the routing protocol daemon, which can disrupt routing for the affected device and potentially for networks that depend on it (blast radius depends on the device's role — a PE/edge router outage propagates farther than an access-layer device).

CVSS 3.1 subscores (base 7.6, High):

• AV:A (Adjacent) — the attacker must be on an adjacent network; this raises the bar relative to network-remote (AV:N) and is why the score sits at High rather than Critical.
• AC:L (Low) — no special conditions or race windows are required beyond the configuration precondition.
• PR:N (None) — no authentication is needed.
• UI:N (None) — no user action is required.
• S:U (Unchanged) — impact is contained to the vulnerable component.
• C:L / I:L / A:H — limited confidentiality and integrity impact; high availability impact (daemon/routing outage).

CISA KEV: NO. EPSS: not yet scored by FIRST.org — no EPSS value can be reported and none is fabricated here. No known threat actor campaigns or exploit-in-the-wild evidence is present in the supplied data. This is best characterized as a pre-exploit, no-public-PoC memory-safety defect in a core routing daemon — high organizational relevance for Juniper fleets running IS-IS.

Detection Guidance

Sigma Rule

title: Potential IS-IS Related rpd Anomaly (CVE-2026-102177)
id: 8f2c4a10-6b7e-4c2a-9d31-1a2b3c4d5e60
status: experimental
description: Detects rpd process crashes/restarts on Juniper Junos that may be associated with malicious IS-IS input when link protection and backup-selection are enabled.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102177
author: valtersit.com
date: 2026-01-01
logsource:
  product: juniper
  service: junos
detection:
  selection_event:
    - message|contains: 'rpd'
  selection_fault:
    - message|contains:
      - 'rpd.*core'
      - 'rpd.*restart'
      - 'rpd.*signal'
      - 'rpd.*abort'
  condition: selection_event and selection_fault
falsepositives:
  - Legitimate rpd restarts during upgrades or configuration commits
level: medium
tags:
  - attack.t1499
  - cve.2026.102177

YARA Rule

rule CVE_2026_102177_ISIS_rpd_OOB_write
{
    meta:
        description = "Heuristic detection for crafted IS-IS PDUs targeting Junos rpd out-of-bounds write (CVE-2026-102177). IS-IS PDUs carry protocol discriminator 0x83."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102177"
        date = "2026-01-01"
    strings:
        $isis_discriminator = { 83 }
        $isis_header_nlpid  = { 83 14 }        // proto discriminator + NLPID
        $isis_hello         = { 83 14 0f 12 }  // IS-IS Hello PDU indicator (heuristic)
        $lsp_marker         = { 83 14 1b }     // LSP-related indicator (heuristic)
    condition:
        // Heuristic: match IS-IS protocol PDUs; review in conjunction with
        // adjacency context and affected feature configuration.
        $isis_discriminator at 0 and $isis_header_nlpid and ( $isis_hello or $lsp_marker )
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-102177 Possible IS-IS PDU with malformed length targeting Junos rpd"; \
  flow:stateless; \
  byte_test:1,=,0x83,0; \
  dsize:>20; \
  threshold:type both,track by_src,count 20,seconds 5; \
  classtype:attempted-dos; \
  sid:2026102177; rev:1; \
  metadata:cve CVE-2026-102177; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102177;)

Note: IS-IS is a link-local protocol and is generally not visible to standard switched/SPAN captures unless an adjacency is monitored on a routing segment. TCP/IP-based Suricata deployments have limited visibility into IS-IS frames by default; deploy taps on router-to-router links where IS-IS adjacency traffic is observable.

Elastic Detection

sequence by host.id with maxspan=5m
  [ process where event.type == "start" and process.name == "rpd" ]
  [ process where event.action == "crash" or (event.type == "end" and process.exit_code != 0) ]

Interpretation: correlates an rpd process start (restart) followed by an abnormal exit, indicative of daemon crashes that may result from malformed IS-IS input. Adjust field names to match the Junos → syslog → Elastic pipeline in use.

Splunk SPL Query

index=juniper sourcetype=juniper:junos "rpd"
| eval fault=case(
    match(_raw,"(?i)rpd.*core"),"core",
    match(_raw,"(?i)rpd.*restart"),"restart",
    match(_raw,"(?i)rpd.*signal"),"signal",
    match(_raw,"(?i)rpd.*abort"),"abort",
    true(),null())
| where isnotnull(fault)
| stats count min(_time) as first_seen max(_time) as last_seen values(fault) as faults by host
| where count > 2
| sort - count

Tune index/sourcetype to your Junos log ingestion and thresholds to your environment's baseline restart frequency.

Wazuh OSSEC Rule

<group name="juniper,junos,rpd,">
  <rule id="100770" level="10">
    <decoded_as>juniper-junos</decoded_as>
    <match>rpd</match>
    <regex>(?i)(core|restart|signal|abort)</regex>
    <description>Juniper rpd process anomaly - possible CVE-2026-102177 IS-IS triggered crash</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_102177,</group>
  </rule>
</group>

Assumes a juniper-junos decoder is present. Adjust the rule id and decoder name to avoid collisions with existing local rules.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix: N/A. Workarounds documented in source data: N/A. Because no fixed version is identified, the following are defensive recommendations consistent with the vulnerability class and the stated enabling configuration; they are not vendor-validated fixes.

1. Immediate mitigations (reduce reachability and exposure):

   • Where operationally feasible, disable IS-IS link protection and/or backup-selection on affected devices — the NVD description states these are the enabling configuration. Validate the routing-design impact before changing production routing features.
   • Restrict IS-IS adjacency formation and PDU injection to trusted, directly connected routing peers. Apply link-level protections (802.1X, MACsec/encryption, port security, and dropping unauthenticated Layer 2 access) so adjacent, unauthenticated hosts cannot inject IS-IS traffic — directly countering the CVSS AV:A / PR:N profile.
   • Implement passive IS-IS authentication (HMAC-MD5 or SHA) where the deployment supports it, so peers reject PDUs from unauthenticated sources — note this is a generic IS-IS hardening measure, not specific to this CVE's code path.
   • Segment and firewall control-plane traffic so non-routing hosts cannot reach the routing adjacency domain.

2. Patch / upgrade steps (when available):

   • Monitor Juniper's security advisories (JSA) portal for the advisory and fixed Junos OS / Junos OS Evolved release corresponding to CVE-2026-102177. As of this report, no vendor fix is identified in tracked sources.
   • When a fixed release is published, upgrade the affected Junos OS / Junos OS Evolved trains per Juniper's recommended upgrade path, and prefer the vendor-identified "resolved in" release for each train rather than an arbitrary recent version.
   • After upgrading, confirm the vulnerable configuration still functions as intended and that rpd stability is restored under IS-IS load.

3. Long-term hardening:

   • Track the vendor JSA and CISA advisories for this CVE; re-score once an EPSS value and any KEV status become available.
   • Enforce least-privilege Layer 2/3 adjacency: no untrusted devices on routing segments carrying IS-IS.
   • Enable control-plane policing (CoPP) and rpd/core-dump alerting so daemon crashes are detected and correlated promptly.
   • Maintain configuration baselines so you can rapidly identify which devices have IS-IS link protection and backup-selection enabled (i.e., which are in scope).

References

• NVD — CVE-2026-102177: https://nvd.nist.gov/vuln/detail/CVE-2026-102177
• CWE-787 Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• Juniper Networks Security Advisories (JSA) portal: https://supportportal.juniper.net/s/global-search/%40uri (search advisories for CVE-2026-102177)
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report — re-check): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored — re-check): https://www.first.org/epss/

Threat-actor note: No named threat actor, campaign, or exploit-in-the-wild evidence is present in the supplied data. No public PoC, exploit code, or Nuclei template exists for this CVE at time of writing.