{"id":"CVE-2026-102182","published":"2026-10-14T17:18:06.080","lastModified":"2026-10-15T16:24:19.073","description":"A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  All versions before 21.2R3-S11;\n  *  from 21.4 before 21.4R3-S12;\n  *  from 22.2 before 22.2R3-S8;\n  *  from 22.3 before 22.3R3-S5;\n  *  from 22.4 before 22.4R3-S9;","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112196","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A stack-based buffer overflow in Juniper's kmd component allows unauthenticated attackers to execute code as root via specially crafted IKE certificate packets. This represents a critical remote code execution vulnerability that could lead to complete system compromise.","exploitability":"Exploitation is relatively straightforward as it requires only sending specific IKE certificate-based packets over the network without authentication, making it highly suitable for automated attacks.","blast_radius":"The vulnerability affects all MX Series routers running supported Junos OS versions, potentially impacting critical network infrastructure with widespread remote access capabilities and high-value network services.","remediation":"Upgrade to 21.2R3-S11, 21.4R3-S12, 22.2R3-S8, 22.3R3-S5, or 22.4R3-S9 depending on the current version, as these releases contain the necessary patches for the kmd component buffer overflow.","detection":"Monitor for unusual IKE packet processing activity in system logs, particularly around certificate handling operations, and watch for unexpected kmd process restarts or memory allocation errors in the Junos OS logs.","tags":["rce","ike","network","juniper","stack-overflow"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:51:21.466Z"}}