CVE-2026-102182 (GCVE-0-2026-102182)
Vulnerability from cvelistv5
Published
2026-10-14 16:57
Modified
2026-10-20 20:30
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
CWE
  • CWE-121 - Stack-based Buffer Overflow
Summary
A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable. This issue affects Junos OS on MX Series: * All versions before 21.2R3-S11; * from 21.4 before 21.4R3-S12; * from 22.2 before 22.2R3-S8; * from 22.3 before 22.3R3-S5; * from 22.4 before 22.4R3-S9;
References
Impacted products
Vendor Product Version
Juniper Networks Junos OS Version: 0   < 23.2R2-S7.7
Version: 23.4   < 23.4R2-S8.13
Version: 24.2   < 24.2R2-S5.5
Version: 24.4   < 24.4R2-S5
Version: 25.2   < 25.2R2-S2
Version: 25.4   < 25.4R1-S3
Version: 26.2   < 26.2R1-S2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102182",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T03:57:08.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "MX Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "23.2R2-S7.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "23.4R2-S8.13",
              "status": "affected",
              "version": "23.4",
              "versionType": "custom"
            },
            {
              "lessThan": "24.2R2-S5.5",
              "status": "affected",
              "version": "24.2",
              "versionType": "custom"
            },
            {
              "lessThan": "24.4R2-S5",
              "status": "affected",
              "version": "24.4",
              "versionType": "custom"
            },
            {
              "lessThan": "25.2R2-S2",
              "status": "affected",
              "version": "25.2",
              "versionType": "custom"
            },
            {
              "lessThan": "25.4R1-S3",
              "status": "affected",
              "version": "25.4",
              "versionType": "custom"
            },
            {
              "lessThan": "26.2R1-S2",
              "status": "affected",
              "version": "26.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerable systems require two \n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003econfiguration \u003c/span\u003e\n\nconditions to be met:\n\u003cbr\u003e\n\u003cbr\u003e- Condition 1: kmd up and accepting IKE on a gateway address\u003cbr\u003e\u003cbr\u003e\n\n\u003ctt\u003e[ interfaces \u0026lt;interface\u0026gt; unit 0 family inet ]\u003cbr\u003e[ services service-set VPN interface-service service-interface \u0026lt;interface\u0026gt; ]\u003cbr\u003e[ services service-set VPN ipsec-vpn-options local-gateway \u0026lt;address\u0026gt; ]\u003cbr\u003e[ services service-set VPN ipsec-vpn-rules R1 ]\u003cbr\u003e[ services ipsec-vpn rule R1 match-direction input ]\u003cbr\u003e[ services ipsec-vpn rule R1 term T1 then remote-gateway \u0026lt;address\u0026gt; ]\u003cbr\u003e[ services ipsec-vpn rule R1 term T1 then dynamic ike-policy IKE-POL ]\u003c/tt\u003e\u003cbr\u003e\n\u003cbr\u003e- Condition 2: RSA-signature IKE policy with a CA-signed local certificate\u003cbr\u003e\n\u003cbr\u003e\n\u003ctt\u003e[ services ipsec-vpn ike proposal IKE-PROP authentication-method rsa-signatures ]\u003cbr\u003e[ services ipsec-vpn ike policy IKE-POL mode aggressive ]\u003cbr\u003e[ services ipsec-vpn ike policy IKE-POL proposals IKE-PROP ]\u003cbr\u003e[ services ipsec-vpn ike policy IKE-POL local-certificate EE-CERT ]\u003cbr\u003e[ security pki ca-profile CA1 ca-identity \u0026lt;CA-name\u0026gt; ]\u003cbr\u003e[ services service-set VPN ipsec-vpn-options trusted-ca CA1 ]\u003c/tt\u003e\n\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Vulnerable systems require two \n\nconfiguration \n\nconditions to be met:\n\n\n\n- Condition 1: kmd up and accepting IKE on a gateway address\n\n\n\n[ interfaces \u003cinterface\u003e unit 0 family inet ]\n[ services service-set VPN interface-service service-interface \u003cinterface\u003e ]\n[ services service-set VPN ipsec-vpn-options local-gateway \u003caddress\u003e ]\n[ services service-set VPN ipsec-vpn-rules R1 ]\n[ services ipsec-vpn rule R1 match-direction input ]\n[ services ipsec-vpn rule R1 term T1 then remote-gateway \u003caddress\u003e ]\n[ services ipsec-vpn rule R1 term T1 then dynamic ike-policy IKE-POL ]\n\n\n- Condition 2: RSA-signature IKE policy with a CA-signed local certificate\n\n\n\n[ services ipsec-vpn ike proposal IKE-PROP authentication-method rsa-signatures ]\n[ services ipsec-vpn ike policy IKE-POL mode aggressive ]\n[ services ipsec-vpn ike policy IKE-POL proposals IKE-PROP ]\n[ services ipsec-vpn ike policy IKE-POL local-certificate EE-CERT ]\n[ security pki ca-profile CA1 ca-identity \u003cCA-name\u003e ]\n[ services service-set VPN ipsec-vpn-options trusted-ca CA1 ]"
        }
      ],
      "datePublic": "2026-10-14T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\u003cbr\u003e\u003cbr\u003eThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Junos OS on MX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eAll versions before 21.2R3-S11;\u003c/li\u003e\u003cli\u003efrom 21.4 before 21.4R3-S12;\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S8;\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R3-S5;\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3-S9;\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\n\nThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\n\nThis issue affects Junos OS on MX Series:\n\n\n  *  All versions before 21.2R3-S11;\n  *  from 21.4 before 21.4R3-S12;\n  *  from 22.2 before 22.2R3-S8;\n  *  from 22.3 before 22.3R3-S5;\n  *  from 22.4 before 22.4R3-S9;"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T20:30:29.536Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA112196"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": true,
              "type": "text/html",
              "value": "The following software releases have been updated to resolve this specific issue:\u003cbr\u003e\n\u003cbr\u003e\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eNote:\u003c/b\u003e For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\n\n\n\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\n\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory."
        }
      ],
      "source": {
        "advisory": "JSA112196",
        "defect": [
          "1952216"
        ],
        "discovery": "INTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-14T16:00:00.000Z",
          "value": "Initial Publication"
        },
        {
          "lang": "en",
          "time": "2026-10-20T16:00:00.000Z",
          "value": "Added required IKE configuration"
        }
      ],
      "title": "Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds for this issue."
            }
          ],
          "value": "There are no known workarounds for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2026-102182",
    "datePublished": "2026-10-14T16:57:50.508Z",
    "dateReserved": "2026-09-28T18:17:13.470Z",
    "dateUpdated": "2026-10-20T20:30:29.536Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-102182\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-14T17:38:31.469382Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-14T19:04:23.289Z\"}}], \"cna\": {\"title\": \"Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution\", \"source\": {\"defect\": [\"1952216\"], \"advisory\": \"JSA112196\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"AUTOMATIC\", \"baseScore\": 9.3, \"Automatable\": \"YES\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Juniper Networks\", \"product\": \"Junos OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"23.2R2-S7.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"23.4\", \"lessThan\": \"23.4R2-S8.13\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"24.2\", \"lessThan\": \"24.2R2-S5.5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"24.4\", \"lessThan\": \"24.4R2-S5\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"25.2\", \"lessThan\": \"25.2R2-S2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"25.4\", \"lessThan\": \"25.4R1-S3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"26.2\", \"lessThan\": \"26.2R1-S2\", \"versionType\": \"custom\"}], \"platforms\": [\"MX Series\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-14T16:00:00.000Z\", \"value\": \"Initial Publication\"}, {\"lang\": \"en\", \"time\": \"2026-10-20T16:00:00.000Z\", \"value\": \"Added required IKE configuration\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The following software releases have been updated to resolve this specific issue:\\n\\n\\n\\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\\n\\nNote: For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The following software releases have been updated to resolve this specific issue:\u003cbr\u003e\\n\u003cbr\u003e\\nJunos OS: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eNote:\u003c/b\u003e For Junos OS releases 23.2, 23.4, and 24.2, specific respins have been referenced. Previously published versions of these releases have been rebuilt to resolve the security vulnerabilities identified in this advisory.\", \"base64\": true}]}], \"datePublic\": \"2026-10-14T16:00:00.000Z\", \"references\": [{\"url\": \"https://supportportal.juniper.net/JSA112196\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There are no known workarounds for this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"There are no known workarounds for this issue.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\\n\\nThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\\n\\nThis issue affects Junos OS on MX Series:\\n\\n\\n  *  All versions before 21.2R3-S11;\\n  *  from 21.4 before 21.4R3-S12;\\n  *  from 22.2 before 22.2R3-S8;\\n  *  from 22.3 before 22.3R3-S5;\\n  *  from 22.4 before 22.4R3-S9;\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets.\u003cbr\u003e\u003cbr\u003eThis issue requires IKE to be enabled with an RSA-signature IKE policy to be vulnerable.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eThis issue affects Junos OS on MX Series:\u003cbr\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eAll versions before 21.2R3-S11;\u003c/li\u003e\u003cli\u003efrom 21.4 before 21.4R3-S12;\u003c/li\u003e\u003cli\u003efrom 22.2 before 22.2R3-S8;\u003c/li\u003e\u003cli\u003efrom 22.3 before 22.3R3-S5;\u003c/li\u003e\u003cli\u003efrom 22.4 before 22.4R3-S9;\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-121\", \"description\": \"CWE-121 Stack-based Buffer Overflow\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Vulnerable systems require two \\n\\nconfiguration \\n\\nconditions to be met:\\n\\n\\n\\n- Condition 1: kmd up and accepting IKE on a gateway address\\n\\n\\n\\n[ interfaces \u003cinterface\u003e unit 0 family inet ]\\n[ services service-set VPN interface-service service-interface \u003cinterface\u003e ]\\n[ services service-set VPN ipsec-vpn-options local-gateway \u003caddress\u003e ]\\n[ services service-set VPN ipsec-vpn-rules R1 ]\\n[ services ipsec-vpn rule R1 match-direction input ]\\n[ services ipsec-vpn rule R1 term T1 then remote-gateway \u003caddress\u003e ]\\n[ services ipsec-vpn rule R1 term T1 then dynamic ike-policy IKE-POL ]\\n\\n\\n- Condition 2: RSA-signature IKE policy with a CA-signed local certificate\\n\\n\\n\\n[ services ipsec-vpn ike proposal IKE-PROP authentication-method rsa-signatures ]\\n[ services ipsec-vpn ike policy IKE-POL mode aggressive ]\\n[ services ipsec-vpn ike policy IKE-POL proposals IKE-PROP ]\\n[ services ipsec-vpn ike policy IKE-POL local-certificate EE-CERT ]\\n[ security pki ca-profile CA1 ca-identity \u003cCA-name\u003e ]\\n[ services service-set VPN ipsec-vpn-options trusted-ca CA1 ]\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Vulnerable systems require two \\n\\n\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003econfiguration \u003c/span\u003e\\n\\nconditions to be met:\\n\u003cbr\u003e\\n\u003cbr\u003e- Condition 1: kmd up and accepting IKE on a gateway address\u003cbr\u003e\u003cbr\u003e\\n\\n\u003ctt\u003e[ interfaces \u0026lt;interface\u0026gt; unit 0 family inet ]\u003cbr\u003e[ services service-set VPN interface-service service-interface \u0026lt;interface\u0026gt; ]\u003cbr\u003e[ services service-set VPN ipsec-vpn-options local-gateway \u0026lt;address\u0026gt; ]\u003cbr\u003e[ services service-set VPN ipsec-vpn-rules R1 ]\u003cbr\u003e[ services ipsec-vpn rule R1 match-direction input ]\u003cbr\u003e[ services ipsec-vpn rule R1 term T1 then remote-gateway \u0026lt;address\u0026gt; ]\u003cbr\u003e[ services ipsec-vpn rule R1 term T1 then dynamic ike-policy IKE-POL ]\u003c/tt\u003e\u003cbr\u003e\\n\u003cbr\u003e- Condition 2: RSA-signature IKE policy with a CA-signed local certificate\u003cbr\u003e\\n\u003cbr\u003e\\n\u003ctt\u003e[ services ipsec-vpn ike proposal IKE-PROP authentication-method rsa-signatures ]\u003cbr\u003e[ services ipsec-vpn ike policy IKE-POL mode aggressive ]\u003cbr\u003e[ services ipsec-vpn ike policy IKE-POL proposals IKE-PROP ]\u003cbr\u003e[ services ipsec-vpn ike policy IKE-POL local-certificate EE-CERT ]\u003cbr\u003e[ security pki ca-profile CA1 ca-identity \u0026lt;CA-name\u0026gt; ]\u003cbr\u003e[ services service-set VPN ipsec-vpn-options trusted-ca CA1 ]\u003c/tt\u003e\\n\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"shortName\": \"juniper\", \"dateUpdated\": \"2026-10-20T20:30:29.536Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-102182\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-20T20:30:29.536Z\", \"dateReserved\": \"2026-09-28T18:17:13.470Z\", \"assignerOrgId\": \"8cbe9d5a-a066-4c94-8978-4b15efeae968\", \"datePublished\": \"2026-10-14T16:57:50.508Z\", \"assignerShortName\": \"juniper\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.