Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
Impact
A stack buffer overflow vulnerability in Juniper Networks Session Smart Router's DHCP client allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply, affecting versions less than 7.0.5, 7.1.7, and 7.2.3. The attacker must have access to the local network. The vulnerability is due to a stack-based buffer overflow weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
The following software releases of Session Smart Router have been updated to resolve these specific issues:
- 7.0.5
and all subsequent releases;
- 7.1.7
and all subsequent releases;
- 7.2.3 and all subsequent releases.
There are no known workarounds for this issue.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Juniper Networks · juniper
Session Smart Router
3 ranges
Juniper Networks · juniper
Session Smart Router
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 7.0.5
custom versions
7.1.0 → before 7.1.7
custom versions
7.2.0 → before 7.2.3
custom versions
Other versions: unaffected
Original source description
A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-103408View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.