Juniper Junos OS Evolved: OS command injection in bootzd zero-touch provisioning
Summary
Junos OS Evolved on Juniper PTX Series routers contains an OS command injection flaw in the bootzd zero-touch provisioning daemon. An unauthenticated attacker on the management LAN can send a crafted gRPC response and execute commands as root, which gives full control of the device. Exploitation requires network access to the management LAN and that zero-touch provisioning is used. PTX is a high-end core router platform, so the risk is mainly relevant for carrier, ISP and data-centre operators.
Affected
- Junos OS Evolved 24.4 before 24.4R2-S5-EVO
- Junos OS Evolved 25.2 before 25.2R2-S2-EVO
- Junos OS Evolved 25.4 before 25.4R1-S3-EVO
- Junos OS Evolved 26.2 before 26.2R1-S2-EVO
- Junos OS Evolved 23.4X100
- Junos OS Evolved 25.2X100 before 25.2X100-D35-EVO
- Junos OS Evolved 25.4X300 before 25.4X300-D40-EVO
- Default configuration: not affected
Fixed in
- Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO
- Junos OS Evolved 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO
- Junos OS Evolved 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO
- All subsequent releases
- Previously published 23.2-EVO, 23.4-EVO and 24.2-EVO releases have been rebuilt (respins).
Workaround
- No workaround is listed in the CNA record.
- Until patched, a third-party source reports disabling or securing zero-touch provisioning on the management LAN and limiting access to trusted administrators. This is not confirmed by the vendor advisory.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS about 3.9 percent at last capture.
- No public proof-of-concept found at the time of writing.
Our recommendation
- Check whether any PTX Series router runs Junos OS Evolved and whether zero-touch provisioning is enabled.
- Restrict management LAN access to trusted administrators.
- Schedule an upgrade to a fixed release listed in JSA112250.
- Verify exact version numbers in the Juniper advisory before rollout.
- Most SMEs do not operate PTX routers, so no action is needed unless such devices are in use or managed for you.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112250 supportportal.juniper.net
- Vulnrichment record CVE-2026-101978 vulners.com
- Strix CVE record CVE-2026-101978 www.strix.ai
- OpenCVE record CVE-2026-101978 app.opencve.io
- Juniper Zero Touch Provisioning documentation www.juniper.net
- SecurityOnline report on Juniper Junos OS vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:51.
Original description (NVD)
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated attacker on the management LAN to execute commands as root via a crafted gRPC response.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.