Session Smart Router EUVD-2026-112211

Exploitation requires that the router's DPI certificate scanner actually inspect an attacker-influenced TLS server certificate - i.e., deep packet inspection of TLS traffic must be in a deployment/configuration where the malicious certificate reaches the vulnerable scanner. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed and attack complexity is low, so against a router with this inspection path active the attack is remote and unauthenticated. The impact is limited strictly to availability (C:N/I:N/A:H) - denial of service only, with no disclosure or modification. The key limiting factor is the DPI-certificate-inspection code path: deployments where this feature is not exercised are not exposed. Whether that feature is on by default is not confirmed in the available sources; verify against Juniper advisory JSA112183.

This is a CWE-190 integer overflow in the DPI certificate scanner of Juniper Session Smart Router, scored CVSS 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - a network-reachable, low-complexity, unauthenticated flaw whose entire impact is availability (A:H), with no confidentiality or integrity effect. The vendor-assigned priority is 'this_week' (not act_now/emergency), which aligns with a DoS-only outcome rather than code execution or data exposure. No EPSS score, no CISA KEV listing, and no public exploit or PoC reference were supplied, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a serious-but-bounded availability issue that is remotely triggerable but not currently known to be exploited. The practical limiting factor the CVSS vector does not capture is that the vulnerable code path is the DPI certificate scanner, so real-world exposure depends on whether deep packet inspection of TLS certificates is actually enabled on the deployment - this is not independently confirmed in the available sources and should be verified against the Juniper advisory (JSA112183).

An unauthenticated remote attacker positions a TLS server so that the Session Smart Router's DPI engine inspects its certificate (for example, by inducing or responding to a TLS session that transits the router), then presents a specially crafted server certificate whose fields trigger the integer overflow in the certificate scanner. The overflow crashes or wedges the DPI/forwarding process, producing a denial of service. No public exploit code or PoC was identified in the supplied data, and the precise malformed-certificate structure that triggers the overflow is not described in the available sources.