CVE-2026-101967
8.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Unauthenticated attackers on the local management network can execute arbitrary commands as root on the target device. They only need the ability to send spoofed or crafted DHCP responses to the system during zero-touch provisioning.
Root cause
The bootzd zero-touch provisioning daemon fails to sanitize DHCP response parameters before passing them to a system shell.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the patched Junos OS Evolved release referenced in JSA112250; if patching cannot occur immediately, disable zero-touch provisioning or isolate the management network to prevent rogue DHCP responses.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.