9.8
CriticalCVSS 3.1 · from juniper
CVE-2026-103409
Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
Session Smart Router · Missing authentication · CWE-306AffectedSession Smart Router
FixUpdate to 7.0.5, 7.1.7, 7.2.3 or newer
PublishedOct 28, 16:36 · juniper
ScoredOct 28 · 9.8 · juniper
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
From juniper
Affected and fixed versions
ProductAffectedFixed inSession Smart Routerbefore 7.0.57.0.5Session Smart Router7.1.0 – before 7.1.77.1.7Session Smart Router7.2.0 – before 7.2.37.2.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known