Session Smart Router CVE-2026-106079

Exploitation requires the attacker to already hold config-write privileges on the Session Smart Router or Conductor and to supply a malicious YANG configuration whose value reaches AccessManager, which fails to neutralize OS command special elements and runs the input as root. The limiting factor is this config-write authentication level (CVSS PR:L) - the flaw is not exploitable by unauthenticated or read-only users - which confines the realistic threat to lower-tier administrators, insiders, or holders of compromised management credentials; no end-user interaction is required (UI:N) and the management interface is network-reachable (AV:N).

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw that requires privileges (PR:L) - specifically the config-write role named in the description - and yields full confidentiality, integrity and availability impact via arbitrary command execution as root. This is a privilege-to-root escalation rather than a pre-auth breach: an actor must already hold config-write access, so the realistic threat model is a lower-tier administrator, a compromised management credential, or an insider rather than an anonymous internet attacker. No EPSS score, no CISA KEV listing, and no POC or exploit reference are present in the supplied data, so there is no signal of active or probable exploitation; the only quantitative priority cue is the vendor feed's 'this_week' decision label, which reflects a serious-but-not-emergency posture consistent with a vendor-reported authenticated flaw. The signals are internally consistent (high severity, but gated behind an administrative privilege), so this reads as a genuine high-severity issue to patch on a near-term schedule rather than a drop-everything emergency - the PR:L gate is the main factor lowering real-world risk. No conflicting signals were detected in the provided inputs; the main gaps are the absence of EPSS/KEV/POC data and of fixed-version information.

An actor holding config-write privileges on a Session Smart Router or Conductor (a lower-privileged operator, an insider, or an attacker using stolen management credentials) submits a crafted YANG configuration whose value contains shell metacharacters in a field processed by AccessManager. Because the input is not neutralized before being passed to an OS command, the payload executes as root, giving full control of the device. No public exploit was identified at time of analysis; the network vector and low attack complexity mean exploitation is straightforward once the required config-write access is obtained.