Juniper Junos OS Multiple Vulnerabilities (JSA112188)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(372460);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/27");

  script_cve_id(
    "CVE-2026-101980",
    "CVE-2026-101956",
    "CVE-2026-102014",
    "CVE-2026-102069",
    "CVE-2026-102176",
    "CVE-2026-103994",
    "CVE-2026-101973",
    "CVE-2026-102057",
    "CVE-2026-102070",
    "CVE-2026-102048",
    "CVE-2026-102072"
  );
  script_xref(name:"JSA", value:"JSA112188");
  script_xref(name:"IAVA", value:"2026-A-1144");

  script_name(english:"Juniper Junos OS Multiple Vulnerabilities (JSA112188)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the
JSA112188 advisory.

  - An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo
    configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel
    crash. (CVE-2026-101980)

  - An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks Junos
    OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via
    the exposed J-Web web interface. This issue affects Junos OS 25.2 and later. (CVE-2026-101956)

  - A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an
    attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root
    privileges via a malicious RADIUS response. (CVE-2026-102014)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2026-10-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-resolved
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?58258082");
  script_set_attribute(attribute:"see_also", value:"https://supportportal.juniper.net/JSA112188");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA112188");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-101980");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-101980");

  script_cwe_id(120, 121, 122, 191, 287, 409, 476, 617, 770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/27");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
var model = get_kb_item('Host/Juniper/model');

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'23.2R2-S7.7'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2-S8.13'},
  {'min_ver':'24.2', 'fixed_ver':'24.2R2-S5.5'},
  {'min_ver':'24.4', 'fixed_ver':'24.4R2-S5'},
  {'min_ver':'25.2', 'fixed_ver':'25.2R2-S2'},
  {'min_ver':'25.4', 'fixed_ver':'25.4R1-S3', 'fixed_display':'25.4R1-S3, 25.4R2'},
  {'min_ver':'26.2', 'fixed_ver':'26.2R1-S2', 'fixed_display':'26.2R1-S2, 26.2R2'}
];

var caveat = junos_caveat(TRUE);
var buf = junos_command_kb_item(cmd:'show configuration | display set');
if (buf)
{
  # Stanzas each CVE needs together
  var stanza_sets = [
    ["^set .*system extended-echo"],
    ["^set .*protocols ovsdb controller"],
    ["^set .*services rpm twamp client control-connection .* target-address"],
    ["^set .*system services extension-service request-response grpc"],
    ["^set .*interfaces .* unit .* family inet6? dhcp"],
    # CVE-2026-102176
    [
      "^set .*system processes sdk-service enable",
      "^set .*services jdaf routing-instances default"
    ],
    # CVE-2026-102069
    [
      "^set .*chassis satellite-management redundancy-groups chassis-id",
      "^set .*protocols dot1x authenticator interface",
      "^set .*protocols iccp peer"
    ]
  ];

  # CVE-2026-101956 affects 25.2 and later
  if (ver =~ "^(25\.[2-9]|2[6-9]\.|[3-9][0-9]\.)")
    append_element(var:stanza_sets, value:["^set .*system services web-management"]);

  # CVE-2026-102048
  if (model !~ "^(PTX|SRX)")
    append_element(var:stanza_sets, value:[
      "^set .*interfaces \S+ flexible-vlan-tagging",
      "^set .*interfaces \S+ encapsulation flexible-ethernet-services",
      "^set .*interfaces .* unit .* encapsulation vlan-vpls",
      "^set .*protocols oam ethernet fnp interface"
    ]);

  var vuln_config = FALSE;
  var stanzas, pattern;
  foreach stanzas (stanza_sets)
  {
    vuln_config = TRUE;
    foreach pattern (stanzas)
    {
      if (!junos_check_config(buf:buf, pattern:pattern))
      {
        vuln_config = FALSE;
        break;
      }
    }
    if (vuln_config) break;
  }

  if (vuln_config)
    caveat = '';
  # CVE-2026-102014 (RADIUS) and CVE-2026-101973 (CMP enrollment) have no configuration Nessus can check
  else if (report_paranoia < 2)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  else
    caveat =
      '\nNote that none of the configurations checked by Nessus were found. This host ' +
      '\nis reported because CVE-2026-102014 and CVE-2026-101973 depend on RADIUS ' +
      '\nand CMP enrollment configurations that Nessus has not tested for.\n';
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
var report = get_report(ver:ver, fix:fix) + caveat;
security_report_v4(severity:SECURITY_HOLE, port:0, extra:report);