Session Smart Router CVE-2026-103411

Requires the attacker to occupy the adjacent (same L2/broadcast) network as the Session Smart Router and to send a malicious DHCP reply that the router's DhcpMessageDecoder processes - i.e., the router must be acting as a DHCP client/relay consuming replies on a segment the attacker can reach. No authentication and no user interaction are required (PR:N/UI:N). The principal limiting factor is AV:A: the flaw is not remotely routable, so exploitation is confined to attackers with local-segment presence (rogue device, compromised LAN host, or malicious insider). The precise byte/field that drives the integer underflow is not described in the available sources beyond 'malicious DHCP reply'.

This is a moderate-severity, adjacency-gated issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 7.1) indicates an attacker on the adjacent (local) network can trigger the flaw with low complexity and no authentication or user interaction, yielding limited confidentiality loss and high availability impact (denial of service). The vuln.today priority 'this_week' and vendor-sourced disclosure (Juniper) signal a real but non-critical patch window. No EPSS probability was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present in the input, so there is no evidence of active exploitation or public exploit code. The main thing holding real-world risk down is the AV:A constraint - the attacker must already be on the same broadcast/L2 segment to deliver the malicious DHCP reply - so this is not internet-exploitable. Treat it as a genuine but bounded priority: patch on a normal expedited cycle, prioritizing segments where untrusted devices share a link with the router. The CVWE metadata is internally consistent (adjacent DHCP vector matches the description), so there is no AV/description conflict to flag here.

An attacker with a foothold on the same local network segment as a Session Smart Router (e.g., a compromised host or rogue device on the LAN) sends a crafted malicious DHCP reply. The router's DhcpMessageDecoder underflows while parsing the message, leaking a limited amount of information and/or crashing the DHCP handling, producing a denial of service. No public exploit code or PoC reference is present in the supplied data.