A Stack-based Buffer Overflow exists in the dot1x daemon (dot1xd) of Juniper Networks Junos OS devices that function as Junos Fusion Aggregation Devices. When dot1x synchronization is enabled in the required Fusion satellite topology, an adjacent attacker acting as the configured ICCP peer can trigger the overflow. The overflow can cause the dot1x daemon to crash, leading to a denial of service, and the vendor indicates that it may also allow the attacker to execute code with root privileges. The weakness originates from the dot1x component which does not properly validate input size, resulting in a buffer overrun.

All affected versions of Juniper Networks Junos OS or Junos OS Evolved that include the dot1x daemon are listed in the vendor advisory. The adaptive list includes Junos OS 23.2R2-S7.7 and all newer releases, 23.4R2-S8.13 and newer, 24.2R2-S5.5 and newer, 24.4R2-S5 and newer, 25.2R2-S2 and newer, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, as well as the corresponding Junos OS Evolved releases starting at 23.2R2-S7.7-EVO and covering all subsequent releases.

The CVSS base score of 8.7 indicates a high severity vulnerability. The EPSS score of <1% indicates a very low exploitation probability, and the issue is not included in CISA’s KEV. The likely attack vector requires an attacker to be a nearby ICCP peer in the same network, implying that local network compromise or physical proximity is needed. The lack of a public workaround means the only defense is to apply the vendor‑released patches. Failure to patch could allow an attacker to cause a DoS or potentially elevate privileges on the device.