Juniper Session Smart Router/Session Smart Conductor up to 7.0.4/7.1.6/7.2.2 Web Server Handlers path traversal

Summaryinfo

A vulnerability described as very critical has been identified in Juniper Session Smart Router and Session Smart Conductor up to 7.0.4/7.1.6/7.2.2. Impacted is an unknown function of the component Web Server Handlers. Such manipulation leads to path traversal. This vulnerability is listed as CVE-2026-103401. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Juniper Session Smart Router and Session Smart Conductor up to 7.0.4/7.1.6/7.2.2. It has been rated as very critical. Affected by this issue is an unknown code block of the component Web Server Handlers. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.

The advisory is shared for download at supportportal.juniper.net. This vulnerability is handled as CVE-2026-103401 since 09/30/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/28/2026). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 7.0.5, 7.1.7 or 7.2.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Session Smart Conductor
• Session Smart Router

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.2.0
• 7.2.1
• 7.2.2

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion