Session Smart Router CVE-2026-103400

Exploitation requires local access to the Session Smart Router or Conductor with low-level privileges (PR:L) sufficient to create directories read by the ember service, plus the ability to cause a service restart for the crafted directory names to take effect. The specific prerequisite is the creation of specially named directories that the ember service improperly neutralizes, triggering arbitrary filesystem unmounts or a crash. Limiting factors: there is no network vector (AV:L), the attacker must already be authenticated on the device, and impact is confined to availability (C:N/I:N/A:H) with no confidentiality or integrity exposure; a service restart must occur for the condition to manifest.

This is a moderate-severity, availability-only issue that does not rise to an urgent priority despite the vendor's 'this_month' decision label. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) confines the attack to a local, already-authenticated actor and limits impact to availability (A:H) with no confidentiality or integrity effect. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is provided, so there is no public exploit identified at time of analysis. The signals are internally consistent - a locally-exploitable DoS reported by the vendor itself - and none conflict, but note that key triage data (EPSS probability, SSVC automatable/technical-impact values) is absent, so the ranking rests on CVSS plus the vendor's 'this_month' label rather than observed exploitation. Overall this reads as a genuine but bounded operational-availability risk requiring an existing foothold, not a high-urgency remotely-exploitable flaw.

An attacker who already has low-privileged local access to a Session Smart Router or Conductor creates one or more specially named directories that the ember service mishandles, then triggers a service restart. On restart the crafted names cause the ember service to unmount arbitrary filesystems or fail, producing a denial of service. No public exploit is identified at time of analysis.