CVE-2026-102061

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS versions prior to 26.2R1-S2 Junos OS Evolved (affected versions not specified)

Description A stack-based buffer overflow exists in the phone-home daemon (phcd) of platforms supporting Secure Zero Touch Provisioning (SZTP). An adjacent unauthenticated attacker can exploit this by sending a crafted DHCP SZTP bootstrap message, potentially leading to arbitrary code execution with root privileges.

Recommendations Update Junos OS to version 23.2R2-S7.7 or later. Update Junos OS to version 23.4R2-S8.13 or later. Update Junos OS to version 24.2R2-S5.5 or later. Update Junos OS to version 24.4R2-S5 or later. Update Junos OS to version 25.2R2-S2 or later. Update Junos OS to version 25.4R1-S3 or later. Update Junos OS to version 26.2R1-S2 or later. Deploy the applicable Junos OS Evolved security update. Restrict rogue DHCP infrastructure. Review provisioning-network segmentation and authorized bootstrap services.