{"id":"CVE-2026-103401","kind":"vulnerability","aliases":["CVE-2026-103401"],"related":[],"title":"Juniper Session Smart Router: link following lets local users overwrite root files","description":"An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.\n\nThis vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.","summary":"Juniper Session Smart Router and Conductor web server handlers follow symbolic links before writing files. A local unprivileged user can overwrite arbitrary files as root through unauthenticated API endpoints.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Session Smart Router","fixed":["7.0.5","7.1.7","7.2.3"],"affected":"< 7.0.5, < 7.1.7, < 7.2.3 (per release train)","ecosystem":"vendor"},{"name":"Session Smart Conductor","fixed":["7.0.5","7.1.7","7.2.3"],"affected":"< 7.0.5, < 7.1.7, < 7.2.3 (per release train)","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","juniper","mist","network-appliance","session-smart-conductor","session-smart-router"],"not_affected_if":["managed-by-conductor"],"how_to_check":"- Inventory every Session Smart Router and Session Smart Conductor and read its software version.\n- Any version before 7.0.5 (7.0 train), 7.1.7 (7.1 train) or 7.2.3 (7.2 train) is affected; Juniper says all versions before these are affected.\n- Exposure requires a low-privilege account or access to the device's management/API interface; restrict that access until patched.\n- The earlier claim that Conductor-managed routers are unaffected is not in Juniper's bulletin; do not rely on it.","fix":"Upgrade Session Smart Router and Conductor to 7.0.5, 7.1.7, 7.2.3 or any later release. No workaround exists per Juniper. Releases past EOE/EOL are not evaluated, so move to a supported train.","status":"open","published_at":"2026-10-28T17:17:24+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:22+00:00","updated_at":"2026-10-28T17:38:33+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-28T17:34:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Juniper Session Smart Router: link following lets local users overwrite root files","impact":"high","summary":"Juniper Session Smart Router and Conductor web server handlers follow symbolic links before writing files. A local unprivileged user can overwrite arbitrary files as root through unauthenticated API endpoints.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","mist","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user overwrites arbitrary root-owned files, leading to full device takeover","analyst_note":"Find Juniper's advisory for affected and fixed versions and the exact unauthenticated endpoints; the NVD entry gives no version data.","how_to_check":"- Identify Session Smart Router and Session Smart Conductor devices in the estate and their software versions, which the sources do not list\n- Check whether each router is managed by a Conductor or by Mist; routers already managed by Conductor are not affected per the description","needs_analyst":true,"not_affected_if":["managed-by-conductor"],"who_is_affected":"Session Smart Routers that are Mist-managed or unmanaged and not yet onboarded to a Conductor can be exploited, per the description. Routers already managed by a Conductor are stated not to be affected. Teams without Juniper Session Smart equipment can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3382,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Juniper's advisory for affected and fixed versions and the exact unauthenticated endpoints; the NVD entry gives no version data.","search":"'-103401':15A,18A '-2026':14A,17A 'access':74C 'affect':139C 'allow':94C 'alreadi':133C 'api':66B,107C 'applianc':30B 'arbitrari':60B,101C 'conductor':24A,34B,44B,93C,131C,136C 'cve':13A,16A 'endpoint':67B,108C 'exploit':113C 'file':12A,53B,61B,73C,102C 'follow':6A,48B,76C 'handler':47B,83C 'improp':69C 'infrastructur':25B 'junip':1A,26B,39B,85C 'let':7A 'link':5A,50B,70C,75C 'local':8A,55B,96C 'manag':117C,134C 'mist':27B,116C 'mist-manag':115C 'network':29B,86C 'network-appli':28B 'onboard':128C 'overwrit':10A,59B,100C 'resolut':71C 'root':11A,63B,104C 'router':4A,21A,38B,42B,89C,118C,122C,132C 'server':46B,82C 'session':2A,19A,22A,32B,36B,40B,87C,91C 'session-smart-conductor':31B 'session-smart-rout':35B 'smart':3A,20A,23A,33B,37B,41B,88C,92C 'symbol':49B 'unauthent':65B,80C,106C 'unmanag':121C 'unprivileg':56B,97C 'user':9A,57B,98C 'via':105C 'vulner':77C,110C 'web':45B,81C 'write':52B 'yet':126C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Juniper Session Smart Router or Session Smart Conductor on a version before 7.0.5, 7.1.7 or 7.2.3. Juniper rates it 8.8 with network attack vector and low privileges required, so an attacker with a low-privilege foothold can overwrite arbitrary files as root and take over the device. Teams without these appliances can skip it; Juniper's bulletin does not list any exclusions.","tier":"B","verified":{"fix":{"at":"2026-10-28T17:38:33Z","by":"analyst","run_id":972},"products":{"at":"2026-10-28T17:38:33Z","by":"analyst","run_id":972},"workarounds":{"at":"2026-10-28T17:38:33Z","by":"analyst","run_id":972}},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103401","severity":null,"published_at":"2026-10-28T17:17:24+00:00","modified_at":"2026-10-28T17:17:24+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103401:972","url":null,"severity":null,"published_at":"2026-10-28T17:38:33+00:00","modified_at":"2026-10-28T17:38:33+00:00","first_seen_at":"2026-10-28T17:38:33+00:00","fetched_at":"2026-10-28T17:38:33+00:00","note":"Read Juniper JSA112183 (2026-10-28) in browser: all SSR/Conductor before 7.0.5, 7.1.7, 7.2.3 affected; CVSS 8.8 AV:N/PR:L (low-privilege authenticated, network-reachable, not purely local as triage said); no workarounds; no known exploitation. Exact endpoints and the Mist/Conductor-managed exclusion are NOT in the bulletin, so left unverified."}],"documents":[{"id":11644,"url":"https://supportportal.juniper.net/s/article/2026-10-On-Demand-Security-Bulletin-Session-Smart-Router-and-Session-Smart-Conductor-Multiple-internally-discovered-vulnerabilities-resolved","title":"JSA112183 Juniper 2026-10 On-Demand Security Bulletin: SSR and Conductor","kind":"advisory","source":"analyst","text":"Juniper JSA112183, 2026-10 On-Demand Security Bulletin: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolved (2026-10-28).\nAffects all versions of SSR and Conductor before 7.0.5, 7.1.7, 7.2.3. Fixed in 7.0.5, 7.1.7, 7.2.3 and all subsequent releases. EOE/EOL releases not evaluated.\nCVE-2026-103401: CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) SSR and Conductor: An attacker can overwrite arbitrary files as root.\nNo known workarounds for all of these issues. Juniper SIRT not aware of malicious exploitation. Found in internal testing.\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}