CVE-2026-103401High· 8.8▾ TwilightAn Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.
This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.
session_smart_router < 7.0.5session_smart_router >= 7.1.0 < 7.1.7session_smart_router >= 7.2.0 < 7.2.3session_smart_conductor < 7.0.5session_smart_conductor >= 7.1.0 < 7.1.7session_smart_conductor >= 7.2.0 < 7.2.3The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:
and all subsequent releases;
and all subsequent releases;
There are no known workarounds for this issue.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103394Low· 3.7Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.
CVE-2026-103390Medium· 5.3Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification
CVE-2026-103391Medium· 5.3Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature
CVE-2026-103392Medium· 4.8Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled
CVE-2026-103400Medium· 5.5Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup
CVE-2026-103393Medium· 4.3Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing