CVE-2026-103404Medium· 6.8▾ SunlitAn Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory.
session_smart_conductor < 7.0.5session_smart_conductor >= 7.1.0 < 7.1.7session_smart_conductor >= 7.2.0 < 7.2.3The following software releases of Session Smart Conductor have been updated to resolve these specific issues:
and all subsequent releases;
and all subsequent releases;
There are no known workarounds for this issue.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103406Critical· 9.8Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
CVE-2026-103394Low· 3.7Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.
CVE-2026-103390Medium· 5.3Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification
CVE-2026-103391Medium· 5.3Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature
CVE-2026-103392Medium· 4.8Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled
CVE-2026-103400Medium· 5.5Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup