CVE-2026-102059
8.8HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Adjacent unauthenticated attackers can execute arbitrary commands as root via a rogue DHCP server. They need local network segment access to send malicious DHCP responses to the device.
Root cause
The phone-home daemon (phcd) fails to sanitize input from DHCP options before passing it to system shell commands.
Affected systems
Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series (exact version numbers not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to the fixed Junos releases cited in advisory JSA112187, or disable the phone-home daemon ('set system phone-home server-ip ...' or disable DHCP autoinstallation) on untrusted broadcast domains.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary commands with root privileges via a rogue DHCP server.