Description

A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T18:17:13.293Z",
  "pubdate": "2026-10-14T18:17:13.293Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the httpd process of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability affects the J-Web management interface when configured with a virtual-domain. The flaw allows an unauthenticated, remote attacker to trigger a crash, resulting in a denial-of-service (DoS) condition, or execute arbitrary code with elevated privileges. Successful exploitation requires no authentication, posing a significant risk to the integrity and availability of the affected networking infrastructure. The vulnerability resides in the way the httpd process handles requests, specifically within the context of virtual-domain configurations, making internet-facing management interfaces particularly high-risk targets for exploitation.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow occurring within the httpd process responsible for powering the J-Web management interface in Junos OS and Junos OS Evolved. The root cause lies in improper bounds checking of user-supplied input when processing requests in a virtual-domain environment. Specifically, the process fails to validate the length of data provided in the request before copying it into a fixed-size buffer allocated on the stack.\nThe attack flow begins with an unauthenticated attacker sending a specially crafted HTTP request to the J-Web service. Because the J-Web interface is exposed to the network, the attacker does not require prior knowledge of legitimate user credentials. The request is processed by the httpd daemon, which subsequently invokes a vulnerable function tasked with parsing input for the virtual-domain configuration. By supplying an input payload that exceeds the capacity of the target buffer, the attacker can overwrite adjacent memory on the stack, including the saved return address.\nBy precisely controlling the data written beyond the buffer, an attacker can hijack the control flow of the httpd process. In an exploitation scenario, the attacker would overwrite the return pointer to redirect execution to a malicious payload, such as a ROP (Return-Oriented Programming) chain or shellcode, injected within the stack or another memory segment. Given that httpd often runs with significant privileges to manage system configurations, successful code execution leads to full system compromise.\nIf the attacker does not successfully execute arbitrary code, the corrupted stack memory will almost certainly trigger a segmentation fault or memory access violation, causing the httpd process to crash. This results in an immediate denial-of-service condition for the J-Web management interface. The vulnerability is highly severe because it leverages a core management component, bypassing authentication mechanisms entirely to gain unauthorized access or disable critical management capabilities."
}