Juniper Junos OS Vulnerability (JSA112173)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(365667);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/14");

  script_cve_id("CVE-2026-102084");
  script_xref(name:"JSA", value:"JSA112173");

  script_name(english:"Juniper Junos OS Vulnerability (JSA112173)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA112173
advisory.

  - An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper
    Networks Junos OS on SRX Series allows an authenticated, network-based attacker to take complete control
    of the device. If an SRX device configured for AutoDiscovery VPN (ADVPN) receives a message from a peer
    that contains one or more specifically malformed attributes, this will cause a buffer overflow, which can
    allow remote code execution and therefore allow an attacker to take complete control of the device. To be
    able to carry out this attack an attacker must either have acquired the shared secret to impersonate a
    peer or have compromised an existing one, so this attack is considerably difficult. This issue affects
    Junos OS on SRX Series: * All versions before 23.2R2-S7.7; * from 23.4 before 23.4R2-S7; * from 24.2
    before 24.2R2-S4; * from 24.4 before 24.4R2-S3; * from 25.2 before 25.2R2; * from 25.4 before 25.4R1-S3.
    (CVE-2026-102084)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-SRX-Series-In-an-ADVPN-scenario-a-malformed-message-from-a-peer-causes-Remote-Code-Execution-CVE-2026-102084
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d5e69ffd");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA112173");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:N/R:U/RE:M");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102084");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/14");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include('junos.inc');

var model = get_kb_item_or_exit('Host/Juniper/model');
if (model !~ "^SRX")
{
  audit(AUDIT_DEVICE_NOT_VULN, model);
}

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'23.2R2-S7.7', 'model':'^SRX'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2-S7', 'model':'^SRX'},
  {'min_ver':'24.2', 'fixed_ver':'24.2R2-S4', 'model':'^SRX'},
  {'min_ver':'24.4', 'fixed_ver':'24.4R2-S3', 'model':'^SRX'},
  {'min_ver':'25.2', 'fixed_ver':'25.2R2', 'model':'^SRX'},
  {'min_ver':'25.4', 'fixed_ver':'25.4R1-S3', 'model':'^SRX'}
];

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix);
security_report_v4(severity:SECURITY_HOLE, port:0, extra:report);