CVE-2026-103409
CriticalCVSS 9.8Summary
A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.
Risk Assessment
An attacker may gain administrative privileges on the device before it is onboarded to Mist/Conductor, potentially leading to full router compromise. Risk applies to devices in the initial provisioning phase.
Recommendation
Restrict network access to devices before onboarding to Mist/Conductor and complete the onboarding process promptly. Apply vendor-provided fixes.
Other vulnerabilities in Juniper Networks Session Smart Router
See all- CVE-2026-103411High
An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.
- CVE-2026-103410High
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.
- CVE-2026-103408High
A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.
- CVE-2026-103405Medium
An injection vulnerability in the web server of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.
- CVE-2026-103400Medium
An injection vulnerability in the ember service of Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart.
- CVE-2026-103394Low
An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service. Exploitation occurs via security policy assignment.
- CVE-2026-103393Medium
An out-of-bounds read vulnerability in the VRRP implementation of Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement.
- CVE-2026-103392Medium
An out-of-bounds write vulnerability in TCP header processing of Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length.
- CVE-2026-103391Medium
An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data. This can potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length.
- CVE-2026-103390Medium
An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service. Exploitation occurs via a specially crafted HTTP request.
Original NVD description (English source)
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS