CVE-2026-102080: Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover
An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS).
If a SyncE or PTP upstream node sends a malformed message to an MX device equipped with SCBE3, a false 19.44MHz alarm is generated on the master RE. This leads to persistent RE switchovers and a clksyncd process crash. This issue is outside the attacker's direct control as it's a race condition.
This issue affects Junos OS on MX Series:
All versions before 23.2R2-S7.7; 23.4 versions before 23.4R2-S8.13; 24.2 versions before 24.2R2-S5.5; 24.4 versions before 24.4R2-S4; 25.2 versions before 25.2R2-S1; 25.4 versions before 25.4R1-S2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 23.2R2-S7.7 - Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 23.4R2-S8.13 - Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 24.2R2-S5.5 - Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 24.4R2-S4 - Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 25.2R2-S1 - Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 25.4R1-S2 - Upgrade
Upgrade
Juniper Junos OS on MX Seriesto a version that resolves this vulnerability.Fixed in 26.2R1
Event History
Frequently Asked Questions
Which devices and deployments are exposed?
The issue affects Junos OS on MX Series devices equipped with SCBE3 when they receive SyncE or PTP clock input from an upstream node. Devices not using this clock-input scenario are not identified as affected by the provided information.
What does an attacker need to exploit this issue?
An unauthenticated attacker must be logically adjacent and able to cause an upstream SyncE or PTP node to send a malformed message to the MX device. Successful impact depends on a race condition and is therefore outside the attacker’s direct control.
What is the operational impact if exploitation succeeds?
A malformed clock message can generate a false 19.44 MHz alarm on the master Routing Engine, causing persistent RE switchovers and a clksyncd process crash. The stated impact is denial of service.
Which releases need remediation?
Affected releases are those before 23.2R2-S7.7; 23.4 releases before 23.4R2-S8.13; 24.2 releases before 24.2R2-S5.5; 24.4 releases before 24.4R2-S4; 25.2 releases before 25.2R2-S1; and 25.4 releases before 25.4R1-S2.