Junos OS: Stack-based buffer overflow in l2cpd via LLDP traffic

Summary

A stack-based buffer overflow in the l2cpd process of Junos OS and Junos OS Evolved can be triggered by LLDP traffic received on an interface where Unified Access Policy is enabled. An adjacent unauthenticated attacker on the same Layer 2 segment can cause a denial of service or execute arbitrary code with root privileges. The vulnerability is only exploitable if the feature is configured; Juniper reports no known malicious exploitation.

Affected

• Junos OS: 0 to before 23.2R2-S7.7; 23.4 to before 23.4R2-S8.13; 24.2 to before 24.2R2-S5.5; 24.4 to before 24.4R2-S5; 25.2 to before 25.2R2-S2; 25.4 to before 25.4R1-S3; 26.2 to before 26.2R1-S2
• Junos OS Evolved: 0 to before 23.2R2-S7.7-EVO; 23.4 to before 23.4R2-S8.11-EVO; 24.2 to before 24.2R2-S5.6-EVO; 24.4 to before 24.4R2-S5-EVO; 25.2 to before 25.2R2-S2-EVO; 25.4 to before 25.4R1-S3-EVO; 26.2 to before 26.2R1-S2-EVO; 23.4X100; 25.2X100 to before 25.2X100-D35-EVO; 25.4X300 to before 25.4X300-D40-EVO
• Required configuration: protocols unified-access-policy

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases
• Verify the per-CVE entry in JSA112187, as the advisory covers several related CVEs.

Workaround

• Disable 'protocols unified-access-policy' on devices where it is not required. Note that this may affect Unified Access Control enforcement.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• No public proof of concept found in the research.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV at the time of research.

Our recommendation

• Check inventory for Junos OS and Junos OS Evolved devices and whether protocols unified-access-policy is configured.
• If configured and not needed, disable it now as an interim measure.
• Read JSA112187 to confirm affected and fixed versions, then schedule the upgrade.
• Restrict LLDP exposure on access ports and user VLANs.
• Re-check CISA KEV, EPSS and NVD, as NVD analysis was still pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE CVE-2026-102049 app.opencve.io
• Positive Technologies PT-2026-113889 vulners.com
• ThreatInt CVE-2026-102049 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:15.