{"id":"CVE-2026-103401","aliases":[],"cve":{"records":[{"id":"CVE-2026-103401","source":"juniper","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-30T14:33:03.168Z","published":"2026-10-28T16:34:44.566Z","modified":"2026-10-28T16:34:44.566Z"}],"publishers":[{"name":"juniper","role":"CNA","organizationId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","modified":"2026-10-28T16:34:44.566Z"}],"references":[{"url":"https://supportportal.juniper.net/JSA112183","tags":["vendor-advisory"],"source":"juniper"}],"weaknesses":[{"id":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')","source":"juniper"}],"applicability":[],"prioritization":[]},"title":"Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root","titleSource":"juniper","descriptionSource":"juniper","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.\n\nThis vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.","score":8.8,"severity":"high","published":"2026-10-28T16:34:44.566Z","modified":"2026-10-28T16:34:44.566Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Juniper Networks","name":"Session Smart Router","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"7.0.5","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.7","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThan":"7.2.3","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"juniper","url":"https://www.cve.org/CVERecord?id=CVE-2026-103401"},{"vendor":"Juniper Networks","name":"Session Smart Conductor","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"7.0.5","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.7","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThan":"7.2.3","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"juniper","url":"https://www.cve.org/CVERecord?id=CVE-2026-103401"}],"remediation":[{"text":"The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:\n  *  7.0.5 \n\nand all subsequent releases;\n  *  7.1.7 \n\nand all subsequent releases;\n  *  7.2.3 and all subsequent releases.","source":"juniper","url":"https://www.cve.org/CVERecord?id=CVE-2026-103401"},{"text":"There are no known workarounds for this issue.","source":"juniper","url":"https://www.cve.org/CVERecord?id=CVE-2026-103401"}],"references":["https://supportportal.juniper.net/JSA112183"],"sources":[{"name":"CVE","id":"CVE-2026-103401","modified":"2026-10-28T16:34:44.566Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-103401"}],"assessments":[{"source":"juniper","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-29T14:08:53.711Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"A local unprivileged user can overwrite arbitrary files as root in Juniper Networks Session Smart Router and Session Smart Conductor versions less than 7.0.5, 7.1.7, and 7.2.3 via unauthenticated API endpoints. This vulnerability affects unmanaged routers and those not yet onboarded to a Conductor. Routers already managed by Conductor are not affected.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:20:34.754Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-103401"}]}}