Skip to content
OpenAdvisories
High · 8.8 CVE-2026-101967 EUVD-2026-101430GHSA-6jx4-gxcf-m37f

Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used

Published Oct 14, 2026 · Updated Nov 4, 2026 · Assigned by juniper

Vendor: Juniper Networks Product: Junos OS Evolved Category: Network devices

Description

An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networks Junos OS Evolved allows an unauthenticated attacker on the management LAN to execute commands as root via crafted DHCP response.

Affected products

VendorProductAffectedFixed
Juniper Networks Junos OS Evolved 24.4 – < 24.4R2-S5-EVO, 25.2 – < 25.2R2-S2-EVO, 25.4 – < 25.4R1-S3-EVO, 26.2 – < 26.2R1-S2-EVO, 23.4X100, 25.2X100 – < 25.2X100-D35-EVO, 25.4X300 – < 25.4X300-D40-EVO 24.4R2-S5-EVO

References