Session Smart Router EUVD-2026-112226

Exploitation requires that transit TCP traffic traverse the SSR's TCP proxy/optimization path and that the attacker can inject a TCP packet with a crafted/malformed TCP option length into that transited flow; the vulnerable code must therefore be engaged on the forwarding path. Per the CVSS vector it is unauthenticated (PR:N) and network-reachable (AV:N) with low complexity (AC:L), so no credentials or user interaction are needed, but the real limiting factor is deployment: the device must be actively proxying/optimizing the attacker's TCP traffic for the out-of-bounds write to be reached. Whether the TCP proxy/optimization feature is enabled by default or only in specific SSR configurations is not stated in the available sources.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) scores 5.3 (Medium) and describes a network-reachable, low-complexity, unauthenticated flaw with only low integrity impact and explicitly no availability impact. However, the description states the out-of-bounds write can 'potentially cause a data-plane crash,' which is an availability outcome that the A:N metric does not capture - these two signals conflict and should be reconciled with the vendor. There is no EPSS score, no CISA KEV listing, and no proof-of-concept in the provided data; the single reference is a Juniper advisory (JSA112183), not exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' not act_now or emergency, consistent with a medium-severity networking-stack bug lacking evidence of active exploitation. Net assessment: a credible but not urgent issue - real because it is unauthenticated and triggerable by ordinary transit traffic, but bounded because the primary demonstrated impact is packet corruption and a possible data-plane crash rather than code execution or data disclosure. Exploitability further depends on the affected TCP proxy/optimization path actually being in the forwarding path, which is not confirmed as a default for all deployments.

An attacker positioned to route TCP traffic through a Session Smart Router sends a transit TCP packet containing a crafted (malformed) TCP option length, which triggers an out-of-bounds write in the SSR TCP proxy/optimization code. This corrupts forwarded packet data and may crash the data plane, disrupting traffic through the device. No proof-of-concept or exploit code is referenced; only a Juniper advisory exists, and the specific trigger beyond 'crafted TCP option length' is not detailed in the available sources.