Session Smart Router CVE-2026-103405

Exploitation requires network reachability to the web server of a Session Smart Router or Conductor and the ability to send request body parameters; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration is indicated against reachable instances. The main limiting factor is impact scope, not access: the flaw only yields HTTP header injection (I:L, C:N, A:N), so realistic risk hinges on whether the web/management interface is network-exposed and on what the injected headers can influence downstream. The sources do not state which characters or parameters trigger the injection.

Signals are mostly moderate and partly incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily reachable, remote, unauthenticated flaw, but the impact is deliberately narrow: C:N/I:L/A:N with a changed scope (S:C), reflecting HTTP header injection into a downstream component rather than code execution or data theft. The base score of 5.8 (MEDIUM) is driven by reachability, not impact depth. EPSS is not provided in the input, so exploitation probability cannot be quantified. KEV status is not listed (no active-exploitation signal), and no public exploit is identified - only a vendor advisory reference. The vuln.today decision label is 'this_month', consistent with a real-but-non-emergency item: worth remediating on a normal patch cadence rather than as an incident. Net: this is a genuine integrity-affecting injection issue, not a false-high - but its real-world severity depends on what the injected headers reach (e.g. response manipulation against clients/proxies), which the available data does not detail.

A remote attacker who can reach the web server of a Session Smart Router or Conductor sends a crafted HTTP request whose body parameters contain unsanitized special characters (e.g. CR/LF). The web server passes these into a downstream component, letting the attacker inject arbitrary HTTP headers into the resulting response. No public exploit code is identified at time of analysis; the mechanism is inferred from CWE-74 and the description, which do not specify the exact trigger characters.