CVE-2026-103401
Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root
Juniper Networks Session Smart RouterNetwork & edge
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.0.5Session Smart RouterCVE List
- 7.1.7Session Smart RouterCVE List
- 7.2.3Session Smart RouterCVE List
- 7.0.5Session Smart ConductorCVE List
- 7.1.7Session Smart ConductorCVE List
- 7.2.3Session Smart ConductorCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.
This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.
Text from CVE List
Affected versions 6
- Session Smart Routeraffected: all versions before 7.0.5CVE List
- Session Smart Routeraffected: 7.1.0 before 7.1.7CVE List
- Session Smart Routeraffected: 7.2.0 before 7.2.3CVE List
- Session Smart Conductoraffected: all versions before 7.0.5CVE List
- Session Smart Conductoraffected: 7.1.0 before 7.1.7CVE List
- Session Smart Conductoraffected: 7.2.0 before 7.2.3CVE List