IT SBIT Services
Schneeberger
DEEN
CVE tracker

Juniper Junos OS: Heap-based buffer overflow in 802.1X daemon secure-dot1xd

CVE-2026-102015High 8.7

← All vulnerabilities

Summary

A heap-based buffer overflow in the secure-dot1xd process of Juniper Junos OS and Junos OS Evolved allows an unauthenticated attacker on the local network to execute code as root or cause a denial of service. The attacker only needs to send a crafted EAPOL frame to an interface that uses 802.1X authentication, and no credentials are required. Internet-facing exposure is not the main risk; a rogue device or compromised host on the same segment could take over a switch or router. Juniper reports no known malicious exploitation.

Affected

  • Junos OS: 0 to below 23.2R2-S7.7; 23.4 to below 23.4R2-S8.13; 24.2 to below 24.2R2-S5.5; 24.4 to below 24.4R2-S5; 25.2 to below 25.2R2-S2; 25.4 to below 25.4R1-S3; 26.2 to below 26.2R1-S2
  • Junos OS Evolved: 0 to below 23.2R2-S7.7-EVO; 23.4 to below 23.4R2-S8.11-EVO; 24.2 to below 24.2R2-S5.6-EVO; 24.4 to below 24.4R2-S5-EVO; 25.2 to below 25.2R2-S2-EVO; 25.4 to below 25.4R1-S3-EVO; 26.2 to below 26.2R1-S2-EVO; 23.4X100; 25.2X100 to below 25.2X100-D35-EVO; 25.4X300 to below 25.4X300-D40-EVO
  • Relevant only where 802.1X (protocols dot1x authenticator) is configured on an interface.

Fixed in

  • Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
  • Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all later releases
  • Releases 23.2, 23.4 and 24.2 have been rebuilt (respins).
  • Unknown: no fixed release is listed for Junos OS Evolved 23.4X100.

Workaround

  • No known workarounds according to the CVE record.
  • Interim measures (own analysis, not vendor-confirmed): restrict physical access to 802.1X-enabled switch ports, disable 802.1X on unused ports, and separate access ports from the management network.

Exploitation

  • Juniper SIRT is not aware of any malicious exploitation.
  • CISA SSVC assessment: exploitation none, automatable no, technical impact total.
  • No public proof-of-concept code was found during research.

Our recommendation

  • Check whether Junos OS or Junos OS Evolved switches and routers use 802.1X (dot1x authenticator).
  • Update affected devices to the fixed releases listed in JSA112187.
  • Verify the advisory for Junos OS Evolved 23.4X100, as no fix is listed in the record.
  • Until patched, limit physical access to 802.1X ports and disable 802.1X on unused ports.
  • Monitor for unexpected EAPOL traffic and for crashes or restarts of secure-dot1xd.
  • Priority: high for access switches with 802.1X enabled; medium where ports are physically controlled.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:28.

Original description (NVD)

A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed