Session Smart Router
Monthly
Juniper Networks Session Smart Router and Session Smart Conductor are exposed to OS command injection through AccessManager, allowing a user who already holds config-write privileges to obtain arbitrary command execution as root by supplying a crafted value in the YANG configuration. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity flaw that is gated by authentication (PR:L) rather than by any user interaction, with full confidentiality, integrity and availability impact once triggered. No public exploit code or active exploitation has been identified at time of analysis, and the realistic threat is confined to lower-tier administrators, insiders or holders of compromised management credentials.
Integer underflow in Juniper Networks Session Smart Router's DhcpMessageDecoder allows an attacker on the adjacent network to cause information disclosure and denial of service by sending a malicious DHCP reply. The issue affects Session Smart Router deployments where the router processes DHCP replies as a client or relay on an attacker-reachable Layer 2 segment; the CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, so no authentication or user interaction is required but exploitation is confined to local-segment presence. No public exploit code or active exploitation is identified in the provided data, and the priority label is this_week.
An integer overflow (CWE-190) in the deep-packet-inspection certificate scanner of Juniper Networks Session Smart Router allows a remote attacker to deny service by feeding a specially crafted TLS server certificate through the inspection path. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), the flaw is network-reachable, low complexity, and requires no authentication or user interaction, but its entire impact is availability - no confidentiality or integrity effect is assessed. Exposure is bounded by configuration: only deployments in which the DPI certificate scanner actually inspects attacker-influenced TLS certificates are reachable, and whether that inspection is enabled by default is not confirmed in the available sources; no public exploit has been identified at time of analysis, and vulnerability prioritization places this in the this-week remediation window rather than an emergency one.
Juniper Networks Session Smart Router exposes an insecure endpoint that runs as root and performs no authentication check, letting a remote attacker who can reach it obtain administrative privileges by passing crafted URL parameters. Per the CVSS vector the attack is network-reachable, unauthenticated (PR:N) and requires no user interaction, so severity is rated 9.8 - but exploitability is gated by deployment state: only devices that have not yet been onboarded to Mist or Conductor are exposed, and the endpoint becomes unreachable once onboarding completes. No KEV listing or public exploit reference appears in the supplied intelligence, so no public exploit identified at time of analysis; the vulnerability is nevertheless tracked as act_now priority because of the pre-auth root-level impact within the pre-onboarding window.
Stack buffer overflow in the DHCP client of Juniper Session Smart Router (CVSS 8.8) lets an unauthenticated attacker on the same local network segment execute arbitrary code by sending a malicious DHCP reply. The CVSS vector AV:A/AC:L/PR:N/UI:N confirms the attack is adjacent-network only, requires no credentials or user interaction, and is not internet-routable; the router must be acting as a DHCP client that accepts and parses the reply. No public exploit was identified at time of analysis, and the supplied sources do not confirm active exploitation.
An authenticated REST API user on Juniper Networks Session Smart Router or Session Smart Conductor can use the ConfigDirector certificate and private-key endpoints to supply a pathname that escapes the intended restricted directory, giving read, overwrite and delete access to arbitrary certificate and key files on the host filesystem. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - network reachable, no user interaction, but gated behind valid REST credentials, which is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked as a this-week priority rather than an emergency, and Juniper advisory JSA112183 is the authoritative reference for affected and fixed releases.
Authenticated OS command injection in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor allows a low-privileged remote user to execute arbitrary commands and delete arbitrary files by way of the deletion of an audit rule. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the principal limiting factor is the authentication requirement: this is not reachable by a fully unauthenticated attacker, and exploitation is confined to the audit-rule deletion path within AccessManager. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the priority signal places it in the current week's remediation queue, and JSA112183 should be consulted to confirm exact affected and fixed versions.
Arbitrary code execution and privilege escalation on Juniper Networks Session Smart Router and Session Smart Conductor occur when the PCLI component processes cache files whose authenticity it never verifies. Exploitation is not remote against a default install: consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker must already hold write access to the model cache directory so that PCLI will ingest the tampered cache file - an authenticated, low-privileged local foothold, even though Juniper's published 8.8 score uses AV:N/AC:L/PR:L/UI:N. No public exploit code was identified in the available intelligence at the time of analysis; the vendor reference is advisory JSA112183, and impact once triggered is full loss of confidentiality, integrity and availability.
A link-following flaw (CWE-59) in the unauthenticated web server handlers of Juniper Networks Session Smart Router and Session Smart Conductor lets a local unprivileged user abuse unauthenticated API endpoints to overwrite arbitrary files with root privileges, giving high confidentiality, integrity and availability impact. The exposure is restricted to Mist-managed routers and unmanaged routers that have not yet been onboarded to a Conductor; routers already managed by a Conductor are explicitly unaffected, which meaningfully narrows the exposed population. No public exploit code or confirmed active exploitation was identified in the available sources, and exploitation requires a local account on the device.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Improper initialization in Juniper Networks Session Smart Router can allow unauthenticated network attackers to cause a limited denial of service, and the description also claims traffic decryption even though the scored confidentiality impact is low. The issue is reached through the router's security policy assignment, and the CVSS AC:H rating indicates conditions beyond the attacker's control; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis, and the vuln.today priority is monitor (CVSS 3.7), making this a low-severity issue rather than an urgent one.
Juniper Networks Session Smart Router can be induced to perform an out-of-bounds read (CWE-125) in its VRRPv3 handling by a crafted VRRP advertisement sent from the same Layer 2 segment, allowing an L2-adjacent attacker to expose stale memory contents or fault the routing process. Affected deployments are those where VRRP is configured and actively running on the targeted interface; the attack requires adjacency on the local broadcast domain but no authentication and no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N). The confidentiality and availability impact is limited and the trigger specifics are not described in the available sources; no public exploit has been identified at time of analysis, and the vendor advisory JSA112183 is the authoritative reference.
An out-of-bounds write in TCP header processing in Juniper Networks Session Smart Router lets unauthenticated remote attackers corrupt TCP payload data and potentially desynchronize sessions by passing a transit TCP packet whose SACK option carries an oversized length field. Only devices that process transit TCP traffic on the attacker's network path are exposed, and the high attack complexity reflects that the malformed-option condition is not straightforwardly triggered. Impact is bounded to integrity and availability effects (I:L/A:L) with no confidentiality loss and no evidence of code execution; no public exploit has been identified at time of analysis, and the issue is tracked as a moderate, this-month priority rather than an emergency.
An out-of-bounds write in the TCP proxy/optimization data plane of Juniper Networks Session Smart Router allows network attackers to corrupt forwarded packet data and potentially crash the data plane by sending a transit TCP packet with a crafted TCP option length. The supplied CVSS vector is network-reachable, low-complexity and unauthenticated (PR:N), but exploitation depends on the SSR actually proxying or optimizing the attacker's TCP traffic; the available sources do not state whether that feature is enabled by default. No public exploit identified at time of analysis, and the supplied data does not report CISA KEV status.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.
Juniper Networks Session Smart Router and Session Smart Conductor are exposed to OS command injection through AccessManager, allowing a user who already holds config-write privileges to obtain arbitrary command execution as root by supplying a crafted value in the YANG configuration. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity flaw that is gated by authentication (PR:L) rather than by any user interaction, with full confidentiality, integrity and availability impact once triggered. No public exploit code or active exploitation has been identified at time of analysis, and the realistic threat is confined to lower-tier administrators, insiders or holders of compromised management credentials.
Integer underflow in Juniper Networks Session Smart Router's DhcpMessageDecoder allows an attacker on the adjacent network to cause information disclosure and denial of service by sending a malicious DHCP reply. The issue affects Session Smart Router deployments where the router processes DHCP replies as a client or relay on an attacker-reachable Layer 2 segment; the CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, so no authentication or user interaction is required but exploitation is confined to local-segment presence. No public exploit code or active exploitation is identified in the provided data, and the priority label is this_week.
An integer overflow (CWE-190) in the deep-packet-inspection certificate scanner of Juniper Networks Session Smart Router allows a remote attacker to deny service by feeding a specially crafted TLS server certificate through the inspection path. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), the flaw is network-reachable, low complexity, and requires no authentication or user interaction, but its entire impact is availability - no confidentiality or integrity effect is assessed. Exposure is bounded by configuration: only deployments in which the DPI certificate scanner actually inspects attacker-influenced TLS certificates are reachable, and whether that inspection is enabled by default is not confirmed in the available sources; no public exploit has been identified at time of analysis, and vulnerability prioritization places this in the this-week remediation window rather than an emergency one.
Juniper Networks Session Smart Router exposes an insecure endpoint that runs as root and performs no authentication check, letting a remote attacker who can reach it obtain administrative privileges by passing crafted URL parameters. Per the CVSS vector the attack is network-reachable, unauthenticated (PR:N) and requires no user interaction, so severity is rated 9.8 - but exploitability is gated by deployment state: only devices that have not yet been onboarded to Mist or Conductor are exposed, and the endpoint becomes unreachable once onboarding completes. No KEV listing or public exploit reference appears in the supplied intelligence, so no public exploit identified at time of analysis; the vulnerability is nevertheless tracked as act_now priority because of the pre-auth root-level impact within the pre-onboarding window.
Stack buffer overflow in the DHCP client of Juniper Session Smart Router (CVSS 8.8) lets an unauthenticated attacker on the same local network segment execute arbitrary code by sending a malicious DHCP reply. The CVSS vector AV:A/AC:L/PR:N/UI:N confirms the attack is adjacent-network only, requires no credentials or user interaction, and is not internet-routable; the router must be acting as a DHCP client that accepts and parses the reply. No public exploit was identified at time of analysis, and the supplied sources do not confirm active exploitation.
An authenticated REST API user on Juniper Networks Session Smart Router or Session Smart Conductor can use the ConfigDirector certificate and private-key endpoints to supply a pathname that escapes the intended restricted directory, giving read, overwrite and delete access to arbitrary certificate and key files on the host filesystem. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - network reachable, no user interaction, but gated behind valid REST credentials, which is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vulnerability is tracked as a this-week priority rather than an emergency, and Juniper advisory JSA112183 is the authoritative reference for affected and fixed releases.
Authenticated OS command injection in the AccessManager component of Juniper Networks Session Smart Router and Session Smart Conductor allows a low-privileged remote user to execute arbitrary commands and delete arbitrary files by way of the deletion of an audit rule. The flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the principal limiting factor is the authentication requirement: this is not reachable by a fully unauthenticated attacker, and exploitation is confined to the audit-rule deletion path within AccessManager. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the priority signal places it in the current week's remediation queue, and JSA112183 should be consulted to confirm exact affected and fixed versions.
Arbitrary code execution and privilege escalation on Juniper Networks Session Smart Router and Session Smart Conductor occur when the PCLI component processes cache files whose authenticity it never verifies. Exploitation is not remote against a default install: consistent with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an attacker must already hold write access to the model cache directory so that PCLI will ingest the tampered cache file - an authenticated, low-privileged local foothold, even though Juniper's published 8.8 score uses AV:N/AC:L/PR:L/UI:N. No public exploit code was identified in the available intelligence at the time of analysis; the vendor reference is advisory JSA112183, and impact once triggered is full loss of confidentiality, integrity and availability.
A link-following flaw (CWE-59) in the unauthenticated web server handlers of Juniper Networks Session Smart Router and Session Smart Conductor lets a local unprivileged user abuse unauthenticated API endpoints to overwrite arbitrary files with root privileges, giving high confidentiality, integrity and availability impact. The exposure is restricted to Mist-managed routers and unmanaged routers that have not yet been onboarded to a Conductor; routers already managed by a Conductor are explicitly unaffected, which meaningfully narrows the exposed population. No public exploit code or confirmed active exploitation was identified in the available sources, and exploitation requires a local account on the device.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Improper initialization in Juniper Networks Session Smart Router can allow unauthenticated network attackers to cause a limited denial of service, and the description also claims traffic decryption even though the scored confidentiality impact is low. The issue is reached through the router's security policy assignment, and the CVSS AC:H rating indicates conditions beyond the attacker's control; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis, and the vuln.today priority is monitor (CVSS 3.7), making this a low-severity issue rather than an urgent one.
Juniper Networks Session Smart Router can be induced to perform an out-of-bounds read (CWE-125) in its VRRPv3 handling by a crafted VRRP advertisement sent from the same Layer 2 segment, allowing an L2-adjacent attacker to expose stale memory contents or fault the routing process. Affected deployments are those where VRRP is configured and actively running on the targeted interface; the attack requires adjacency on the local broadcast domain but no authentication and no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N). The confidentiality and availability impact is limited and the trigger specifics are not described in the available sources; no public exploit has been identified at time of analysis, and the vendor advisory JSA112183 is the authoritative reference.
An out-of-bounds write in TCP header processing in Juniper Networks Session Smart Router lets unauthenticated remote attackers corrupt TCP payload data and potentially desynchronize sessions by passing a transit TCP packet whose SACK option carries an oversized length field. Only devices that process transit TCP traffic on the attacker's network path are exposed, and the high attack complexity reflects that the malformed-option condition is not straightforwardly triggered. Impact is bounded to integrity and availability effects (I:L/A:L) with no confidentiality loss and no evidence of code execution; no public exploit has been identified at time of analysis, and the issue is tracked as a moderate, this-month priority rather than an emergency.
An out-of-bounds write in the TCP proxy/optimization data plane of Juniper Networks Session Smart Router allows network attackers to corrupt forwarded packet data and potentially crash the data plane by sending a transit TCP packet with a crafted TCP option length. The supplied CVSS vector is network-reachable, low-complexity and unauthenticated (PR:N), but exploitation depends on the SSR actually proxying or optimizing the attacker's TCP traffic; the available sources do not state whether that feature is enabled by default. No public exploit identified at time of analysis, and the supplied data does not report CISA KEV status.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.