Description
An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
Published: 2026-10-14
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Remote code execution via OS command injection allowing attackers to run arbitrary commands as root on Junos OS Evolved devices
Action: Apply Patch
AI Analysis

Impact

An OS Command Injection flaw in the bootzd daemon that supports zero-touch provisioning on Juniper Networks Junos OS Evolved permits an attacker to send a crafted DHCP response over the management LAN. The flaw enables the attacker to pass arbitrary shell commands to the operating system, which are executed with root privileges. This results in full system compromise, granting the attacker complete control over confidentiality, integrity, and availability of the affected device.

Affected Systems

The vulnerability affects Juniper Networks Junos OS Evolved running on PTX Series devices. All versions prior to the following releases are impacted: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all releases beyond those stated.

Risk and Exploitability

The flaw carries a CVSS score of 9.3, indicating a high severity bound to local network attacks. The EPSS score is currently unavailable, but the lack of a KEV listing means no publicly documented exploits are known. An attacker with access to the management LAN can issue the hijacked DHCP response without any authentication, making exploitation straightforward for anyone on that network.

Generated by OpenCVE AI on October 14, 2026 at 21:41 UTC.

Remediation

Vendor Solution

The following software releases have been updated to resolve this specific issue: Junos OS Evolved: 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO, and all subsequent releases. Note: For Junos OS Evolved releases 23.2-EVO, 23.4-EVO, and 24.2-EVO, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.

Vendor Workaround

There are no known workarounds for this issue.

OpenCVE Recommended Actions

  • Upgrade Junos OS Evolved to any release listed above or later, including all subsequent releases
  • Ensure zero-touch provisioning is configured only for devices that are explicitly authorized and monitor DHCP traffic for anomalous responses
  • Apply any vendor‑issued patches or version upgrades promptly to mitigate the command injection vulnerability while network changes are validated

Generated by OpenCVE AI on October 14, 2026 at 21:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.
Title Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: juniper

Published:

Updated: 2026-10-15T03:57:18.622Z

Reserved: 2026-09-28T16:28:35.625Z

Link: CVE-2026-101967

cve-icon Vulnrichment

Updated: 2026-10-14T20:39:52.808Z

cve-icon NVD

Status : Received

Published: 2026-10-14T17:17:49.100

Modified: 2026-10-15T04:18:10.040

Link: CVE-2026-101967

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T21:45:07Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')