Session Smart Router EUVD-2026-112212

Exploitable only while the Session Smart Router is in its pre-onboarding state - before it is onboarded to Mist or Conductor; once onboarded, the insecure endpoint is no longer reachable and the issue cannot be exploited. Within that window, the per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, requires no authentication and no user interaction: the attacker needs only network access to the insecure root-running endpoint and passes crafted URL parameters. The primary limiting factor is therefore deployment state (un-onboarded device) plus network reachability to the management/affected endpoint.

Multiple signals align toward high priority but with an important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a remote, unauthenticated, low-complexity path to full administrative compromise of the router, and the vuln.today Decision label is 'act_now' - consistent with a critical missing-authentication flaw (CWE-306) reported by the vendor itself. However, a strong mitigating factor is stated directly in the description: the endpoint is only reachable before the device is onboarded to Mist/Conductor, so exploitation is confined to the pre-onboarding window and is not possible on devices already brought under management. EPSS exploitation probability was not provided, the CVE is not indicated as CISA KEV, and no POC or exploit reference is present, so there is no evidence of active exploitation or public exploit code; the urgency here derives from the Decision label and the CVSS severity, not from observed in-the-wild activity. Net: a genuine critical-severity issue for devices in their initial provisioning state, but the onboarding constraint meaningfully narrows the realistic attack surface versus a raw 9.8 reading.

An attacker with network reachability to a Session Smart Router that has not yet been onboarded to Mist/Conductor sends crafted URL parameters to an insecure endpoint that runs as root, obtaining administrative control without any credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required beyond reaching the device during its pre-onboarding window. No public exploit code or POC reference was provided in the available data.