CVE-2026-103394

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

An injection vulnerability in the web server of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.

An injection vulnerability in the ember service of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart.

An out-of-bounds read vulnerability in the VRRP implementation of Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.

An out-of-bounds write vulnerability in TCP header processing of Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length.

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data. This can potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.

An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service. Exploitation occurs via a specially crafted HTTP request.

A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.