Session Smart Router EUVD-2026-112220

Requires a local unprivileged user account on the device (PR:L, and the description explicitly says 'local'). The device must be in an affected deployment mode: a Mist-managed router, OR an unmanaged router that has not yet been onboarded to a Conductor. Routers already managed by a Conductor are explicitly NOT affected, which is the primary limiting factor and meaningfully narrows the exposed population. The vulnerable path is an unauthenticated web-server API endpoint, so no application-level authentication to that handler is needed once local access exists. The specific symlink/link-resolution trigger and which exact API endpoints are affected are not described in the available sources.

Signals are moderately elevated but conflicting. The vuln.today decision label is 'this_week' (priority, not emergency). The vendor-supplied CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, which on its face suggests remote, low-privilege, easy exploitation with total impact. However, the description directly contradicts the AV:N metric: it states the flaw 'allows a local unprivileged user to overwrite arbitrary files as root,' which is a local attack vector - verify AV with vendor, as this materially lowers real-world reach. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no probabilistic exploitation signal to weigh. The SSVC-style technical impact is high (arbitrary file overwrite as root effectively enables full host compromise), but 'automatable' and 'exploitation' status are not supplied. Net: this is a genuinely serious local privilege-escalation/file-write issue whose headline 8.8 likely overstates remote risk because the described trigger requires local access; treat it as a priority patch on the affected deployment modes rather than an internet-exposed emergency, and reconcile the AV:N-vs-local-user discrepancy with Juniper before basing exposure decisions on the network vector.

A local unprivileged user on an affected Session Smart Router (Mist-managed, or unmanaged and not yet onboarded to a Conductor) reaches an unauthenticated web-server API handler and abuses a link-following (symlink) flaw so that a write operation resolves to an attacker-chosen path. Because the handler runs as root, the user overwrites a root-owned file, escalating to full control of the device. No public exploit code was identified in the provided data; the precise symlink-abuse trigger is not described in the available sources.