Session Smart Router CVE-2026-103407

Requires an authenticated REST API user (PR:L) with access to the ConfigDirector certificate and private-key REST API on a Session Smart Router or Session Smart Conductor; the attacker then supplies a pathname that escapes the intended restricted directory to reach arbitrary host files. The primary limiting factor is authentication - valid REST credentials are mandatory, so the flaw is not reachable by fully unauthenticated attackers - and exploitation targets the specific certificate/private-key endpoints rather than default unauthenticated services. No user interaction is required once credentials are held.

This is a credible this-week priority rather than a theoretical high-CVSS finding. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity path-traversal flaw requiring only an authenticated REST user - a low bar in environments where many operators or integrations hold API credentials. The triple-high impact (C:H/I:H/A:H) is justified because the attacker can read, overwrite, and delete arbitrary certificate and key material, directly threatening the device's cryptographic trust. Mitigating the urgency: exploitation is NOT unauthenticated - PR:L means valid REST credentials are a prerequisite, which bounds the threat to users who already have some access. No EPSS score, no CISA KEV listing, and no public PoC were supplied, so there is no evidence of active exploitation or widespread scanning; the only intelligence signal elevating this beyond a vendor-reported bug is the vuln.today 'this_week' decision label. Net: real and worth prompt patching given the sensitivity of key files and the low attack complexity, but it is credential-gated and shows no current exploitation signal.

An attacker holding a low-privilege REST API account on a Session Smart Router or Conductor (or who has phished/reused such credentials) sends a crafted request to the certificate or private-key REST endpoint with a traversal sequence in the pathname. Because the endpoint fails to confine the path to its intended directory, the attacker reads or deletes the device's TLS private keys or overwrites them, undermining the device's identity and availability. No public exploit code was identified at time of analysis, and exploitation requires valid REST authentication.