Junos OS: Format string flaw in ipfd daemon allows remote code execution
Summary
Juniper Junos OS on SRX Series firewalls contains a format string flaw (CWE-134) in the ipfd daemon. The daemon fetches prefix data from configured Security Intelligence or dynamic-address HTTPS feed servers. An unauthenticated network attacker who compromises or impersonates a configured feed server can execute code with root privileges on the firewall. The flaw only applies when a feed URL is configured.
Affected
- Junos OS 0 to before 23.2R2-S7.7
- Junos OS 23.4 to before 23.4R2-S8.13
- Junos OS 24.2 to before 24.2R2-S5.5
- Junos OS 24.4 to before 24.4R2-S5
- Junos OS 25.2 to before 25.2R2-S2
- Junos OS 25.4 to before 25.4R1-S3
- Junos OS 26.2 to before 26.2R1-S2
- Default configuration: not affected
Fixed in
- Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all later releases
- For 23.2, 23.4 and 24.2, rebuilt respins of previously published versions resolve the issue
- Verify the exact versions against Juniper advisory JSA112186
Workaround
- No known workarounds according to Juniper.
- Risk reduction (not vendor-stated): disable Security Intelligence and dynamic-address feeds that are not needed.
- Restrict outbound access from the firewall to the required feed hosts only.
Exploitation
- Juniper SIRT is not aware of malicious exploitation.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found in the sources checked.
- EPSS score 0.00407.
Our recommendation
- Check whether security-intelligence url or dynamic-address feeds are configured on SRX devices.
- If no feed is needed, remove the configuration.
- If a feed is needed, update Junos OS to a fixed release from JSA112186 and enforce certificate validation with a TLS profile and a trusted CA.
- Restrict outbound firewall access to the feed hosts only and monitor feed connections for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper advisory JSA112186 supportportal.juniper.net
- OpenCVE record CVE-2026-102062 app.opencve.io
- Juniper blog: SRX dynamic IP objects and feed server community.juniper.net
- Strix CVE-2026-102062 www.strix.ai
- SecurityOnline: Juniper patches critical Junos OS vulnerabilities securityonline.info
- Vulners CIRCL CVE-2026-102062 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:30.
Original description (NVD)
An Use of Externally-Controlled Format String vulnerability in the ipfd daemon of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a compromised or impersonated configured HTTPS feed server.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.