Juniper Networks Session Smart Router
18 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-106079 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG confi… | HIGH 8.8 | |||
| CVE-2026-103411 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing | HIGH 7.1 | |||
| CVE-2026-103410 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection | HIGH 7.5 | |||
| CVE-2026-103409 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed | CRITICAL 9.8 | |||
| CVE-2026-103408 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options | HIGH 8.8 | |||
| CVE-2026-103407 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI manage… | HIGH 8.8 | |||
| CVE-2026-103405 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting | MEDIUM 5.8 | |||
| CVE-2026-103403 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting au… | HIGH 8.8 | |||
| CVE-2026-103402 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privi… | HIGH 8.8 | |||
| CVE-2026-103401 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root | HIGH 8.8 | |||
| CVE-2026-103400 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup | MEDIUM 5.5 | |||
| CVE-2026-103394 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. | LOW 3.7 | |||
| CVE-2026-103393 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing | MEDIUM 4.3 | |||
| CVE-2026-103392 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled | MEDIUM 4.8 | |||
| CVE-2026-103391 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature | MEDIUM 5.3 | |||
| CVE-2026-103390 | < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification | MEDIUM 5.3 | |||
| CVE-2025-21589 | 5.6.7 – < 5.6.17 ; 6.1 – < 6.1.12-lts ; 6.2 – < 6.2.8-lts ; … | Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability | CRITICAL 9.3 | 1.5 % | ||
| CVE-2024-2973 | < 5.6.15 ; 6.0 – < 6.1.9-lts ; 6.2 – < 6.2.5-sts | Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed | CRITICAL 10.0 | 1.1 % |