Live › vulnerability › CVE-2026-103401
Go to dashboardJuniper Session Smart Router and Conductor web server handlers follow symbolic links before writing files. A local unprivileged user can overwrite arbitrary files as root through unauthenticated API endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Anyone running Juniper Session Smart Router or Session Smart Conductor on a version before 7.0.5, 7.1.7 or 7.2.3. Juniper rates it 8.8 with network attack vector and low privileges required, so an attacker with a low-privilege foothold can overwrite arbitrary files as root and take over the device. Teams without these appliances can skip it; Juniper's bulletin does not list any exclusions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Session Smart Router | vendor | < 7.0.5, < 7.1.7, < 7.2.3 (per release train) | 7.0.5, 7.1.7, 7.2.3 |
| Session Smart Conductor | vendor | < 7.0.5, < 7.1.7, < 7.2.3 (per release train) | 7.0.5, 7.1.7, 7.2.3 |
7.0.5, 7.1.7, 7.2.3 or any later releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.
This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-103401")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.