Session Smart Conductor
Monthly
Juniper Networks Session Smart Router and Session Smart Conductor are exposed to OS command injection through AccessManager, allowing a user who already holds config-write privileges to obtain arbitrary command execution as root by supplying a crafted value in the YANG configuration. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity flaw that is gated by authentication (PR:L) rather than by any user interaction, with full confidentiality, integrity and availability impact once triggered. No public exploit code or active exploitation has been identified at time of analysis, and the realistic threat is confined to lower-tier administrators, insiders or holders of compromised management credentials.
An authenticated REST API user on Juniper Networks Session Smart Router or Session Smart Conductor can use the ConfigDirector certificate and private-key endpoints to supply a pathname that escapes the intended restricted directory, giving read, overwrite and delete access to arbitrary certificate and key files on the host filesystem. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - network reachable, no user interaction, but gated behind valid REST credentials, which is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked as a this-week priority rather than an emergency, and Juniper advisory JSA112183 is the authoritative reference for affected and fixed releases.
Unauthenticated remote command execution as root affects Juniper Networks Session Smart Conductor through its Salt-based AutomatedProvisioner: a crafted salt minion ID containing shell special characters is not neutralized before being used in an OS command. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, an attacker who can reach the Conductor's provisioning interface needs no credentials and no user interaction, and the injected commands execute with root privileges. No public exploit or CISA KEV entry is identified at time of analysis, but the 9.8 vendor-reported severity and the act_now priority label make reachable management interfaces a high-priority exposure.
Authenticated OS command injection in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor allows a low-privileged remote user to execute arbitrary commands and delete arbitrary files by way of the deletion of an audit rule. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the principal limiting factor is the authentication requirement: this is not reachable by a fully unauthenticated attacker, and exploitation is confined to the audit-rule deletion path within AccessManager. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the priority signal places it in the current week's remediation queue, and JSA112183 should be consulted to confirm exact affected and fixed versions.
Arbitrary code execution and privilege escalation on Juniper Networks Session Smart Router and Session Smart Conductor occur when the PCLI component processes cache files whose authenticity it never verifies. Exploitation is not remote against a default install: consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker must already hold write access to the model cache directory so that PCLI will ingest the tampered cache file - an authenticated, low-privileged local foothold, even though Juniper's published 8.8 score uses AV:N/AC:L/PR:L/UI:N. No public exploit code was identified in the available intelligence at the time of analysis; the vendor reference is advisory JSA112183, and impact once triggered is full loss of confidentiality, integrity and availability.
A link-following flaw (CWE-59) in the unauthenticated web server handlers of Juniper Networks Session Smart Router and Session Smart Conductor lets a local unprivileged user abuse unauthenticated API endpoints to overwrite arbitrary files with root privileges, giving high confidentiality, integrity and availability impact. The exposure is restricted to Mist-managed routers and unmanaged routers that have not yet been onboarded to a Conductor; routers already managed by a Conductor are explicitly unaffected, which meaningfully narrows the exposed population. No public exploit code or confirmed active exploitation was identified in the available sources, and exploitation requires a local account on the device.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
Juniper Networks Session Smart Conductor contains an incorrect permission assignment flaw (CWE-732) in its RoutingManager component: processes that write routing credential material into the /tmp directory create it with permissions that other local users can read. The exposed data is sensitive routing credential information, giving confidentiality-only impact; the independent assessment scores this as a local attack (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requiring an existing account on the Conductor host, which conflicts with the vendor's submitted vector (AV:N/AC:H/PR:N/UI:N/S:C) and should be confirmed against advisory JSA112183. The vendor score is 6.8 and the case is triaged for this month rather than immediate action; no CISA KEV listing and no public exploit code were identified at time of analysis.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.
Juniper Networks Session Smart Router and Session Smart Conductor are exposed to OS command injection through AccessManager, allowing a user who already holds config-write privileges to obtain arbitrary command execution as root by supplying a crafted value in the YANG configuration. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity flaw that is gated by authentication (PR:L) rather than by any user interaction, with full confidentiality, integrity and availability impact once triggered. No public exploit code or active exploitation has been identified at time of analysis, and the realistic threat is confined to lower-tier administrators, insiders or holders of compromised management credentials.
An authenticated REST API user on Juniper Networks Session Smart Router or Session Smart Conductor can use the ConfigDirector certificate and private-key endpoints to supply a pathname that escapes the intended restricted directory, giving read, overwrite and delete access to arbitrary certificate and key files on the host filesystem. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - network reachable, no user interaction, but gated behind valid REST credentials, which is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked as a this-week priority rather than an emergency, and Juniper advisory JSA112183 is the authoritative reference for affected and fixed releases.
Unauthenticated remote command execution as root affects Juniper Networks Session Smart Conductor through its Salt-based AutomatedProvisioner: a crafted salt minion ID containing shell special characters is not neutralized before being used in an OS command. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, an attacker who can reach the Conductor's provisioning interface needs no credentials and no user interaction, and the injected commands execute with root privileges. No public exploit or CISA KEV entry is identified at time of analysis, but the 9.8 vendor-reported severity and the act_now priority label make reachable management interfaces a high-priority exposure.
Authenticated OS command injection in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor allows a low-privileged remote user to execute arbitrary commands and delete arbitrary files by way of the deletion of an audit rule. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the principal limiting factor is the authentication requirement: this is not reachable by a fully unauthenticated attacker, and exploitation is confined to the audit-rule deletion path within AccessManager. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the priority signal places it in the current week's remediation queue, and JSA112183 should be consulted to confirm exact affected and fixed versions.
Arbitrary code execution and privilege escalation on Juniper Networks Session Smart Router and Session Smart Conductor occur when the PCLI component processes cache files whose authenticity it never verifies. Exploitation is not remote against a default install: consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker must already hold write access to the model cache directory so that PCLI will ingest the tampered cache file - an authenticated, low-privileged local foothold, even though Juniper's published 8.8 score uses AV:N/AC:L/PR:L/UI:N. No public exploit code was identified in the available intelligence at the time of analysis; the vendor reference is advisory JSA112183, and impact once triggered is full loss of confidentiality, integrity and availability.
A link-following flaw (CWE-59) in the unauthenticated web server handlers of Juniper Networks Session Smart Router and Session Smart Conductor lets a local unprivileged user abuse unauthenticated API endpoints to overwrite arbitrary files with root privileges, giving high confidentiality, integrity and availability impact. The exposure is restricted to Mist-managed routers and unmanaged routers that have not yet been onboarded to a Conductor; routers already managed by a Conductor are explicitly unaffected, which meaningfully narrows the exposed population. No public exploit code or confirmed active exploitation was identified in the available sources, and exploitation requires a local account on the device.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
Juniper Networks Session Smart Conductor contains an incorrect permission assignment flaw (CWE-732) in its RoutingManager component: processes that write routing credential material into the /tmp directory create it with permissions that other local users can read. The exposed data is sensitive routing credential information, giving confidentiality-only impact; the independent assessment scores this as a local attack (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requiring an existing account on the Conductor host, which conflicts with the vendor's submitted vector (AV:N/AC:H/PR:N/UI:N/S:C) and should be confirmed against advisory JSA112183. The vendor score is 6.8 and the case is triaged for this month rather than immediate action; no CISA KEV listing and no public exploit code were identified at time of analysis.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.