Juniper Junos OS: Stack-based buffer overflow in phcd allows root code execution

Summary

A stack-based buffer overflow in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to execute arbitrary code as root. The attacker only needs to send a crafted DHCP SZTP bootstrap message to the device from the same network segment. The issue only affects platforms that support Secure-ZTP.

Affected

• Junos OS: releases below 23.2R2-S7.7; 23.4 to below 23.4R2-S8.13; 24.2 to below 24.2R2-S5.5; 24.4 to below 24.4R2-S5; 25.2 to below 25.2R2-S2; 25.4 to below 25.4R1-S3; 26.2 to below 26.2R1-S2 (default: unaffected)
• Junos OS Evolved: releases below 23.2R2-S7.7-EVO; 23.4 to below 23.4R2-S8.11-EVO; 24.2 to below 24.2R2-S5.6-EVO; 24.4 to below 24.4R2-S5-EVO; 25.2 to below 25.2R2-S2-EVO; 25.4 to below 25.4R1-S3-EVO; 26.2 to below 26.2R1-S2-EVO; 23.4X100; 25.2X100 to below 25.2X100-D35-EVO; 25.4X300 to below 25.4X300-D40-EVO (default: unaffected)
• Only platforms that support Secure-ZTP. Whether Secure-ZTP is enabled by default: Unknown.

Fixed in

• Junos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases
• Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases
• Juniper states that respins were published for 23.2, 23.4 and 24.2 releases; previously published versions have been rebuilt.

Workaround

Unknown. Juniper states that there are no known workarounds for this issue.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• No public proof of concept or CISA KEV listing was found in the sources reviewed.

Our recommendation

• Check with 'show version' whether a Junos or Junos Evolved device runs an affected release, and whether Secure-ZTP is configured.
• Upgrade affected devices to a fixed release listed in JSA112187 in the next maintenance window; the bulletin covers several other bugs, so plan one upgrade for all of them.
• Restrict who can reach the DHCP and provisioning segment of the device until patched.
• Disable Secure-ZTP if it is not needed, after confirming with Juniper that this is supported on the platform.
• Monitor the provisioning network for unexpected DHCP SZTP traffic and rogue devices.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112187 supportportal.juniper.net
• OpenCVE: CVE-2026-102061 app.opencve.io
• Strix: CVE-2026-102061 www.strix.ai
• Positive Technologies record PT-2026-113901 vulners.com
• SecurityOnline: Juniper patches Junos OS vulnerabilities securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 03:12.