A format string flaw (CWE‑134) in the ipfd daemon of Juniper’s Junos OS allows an unauthenticated network attacker to inject malicious format string data when the device retrieves Security Intelligence updates from a compromised or impersonated HTTPS feed server. The flaw can be triggered without any local access or user credentials, and an attacker can cause the daemon to execute system calls that grant root privileges, enabling full control over the SRX device.

Juniper Networks Junos OS running on SRX Series routers is affected. The vulnerability is present in releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1, and any subsequent release built after those versions. Earlier builds of the 23.2, 23.4, and 24.2 lines have also been rebuilt to resolve the issue.

The CVSS score of 9.2 signifies extreme severity. Explanations of the attack path indicate the flaw can be abused without authentication and purely via network traffic to the router. The EPSS score of 0.00407 (<1%) indicates a very low but nonzero exploitation probability, yet the lack of a published workaround and the presence of a Security Advisory suggest a high risk to affected deployments. The bug is not listed in the CISA KEV catalog. An attacker must compromise or spoof the HTTPS feed server that the SRX uses for Security Intelligence updates; once that server is malicious, injected format string data can be processed, resulting in arbitrary code execution with root privileges, threatening confidentiality, integrity, and availability of the device.