CVE-2026-103409
Juniper Networks Session Smart Router
- Juniper Networks Session Smart Router
- Critical
- CVSS 9.8
- Fixed version listed
Summary
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
From the CVE record.
Read the original description
CVE record
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.
Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Juniper Networks Session Smart Router | before 7.0.5; from 7.1.0, before 7.1.7; from 7.2.0, before 7.2.3 | 7.0.5, 7.1.7, 7.2.3 |
Advisories and fixes
- Vendor advisory supportportal.juniper.net
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1, scored by juniper)
- Weakness
- CWE-306: Missing authentication for critical function
- Vendor
- Juniper Networks, Session Smart Router
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.