{"id":"CVE-2026-103402","kind":"vulnerability","aliases":["CVE-2026-103402"],"related":[],"title":"Juniper Session Smart Router: unverified cache files let local users run code","description":"An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.","summary":"PCLI in Juniper Session Smart Router and Session Smart Conductor processes model cache files without verifying their authenticity. An attacker who can write to the model cache directory can run arbitrary code and escalate privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","network-appliance","session-smart-conductor","session-smart-router"],"not_affected_if":["cache-directory-not-writable-by-others","no-juniper-ssr","no-local-access"],"how_to_check":"Run 'show system version' on each Session Smart Router and Conductor and compare with the fixed releases in Juniper's bulletin for this CVE (not yet confirmed; possibly JSA112528). Check which local accounts can write to the PCLI model cache directory (path not confirmed).","fix":null,"status":"open","published_at":"2026-10-28T17:17:24+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:21+00:00","updated_at":"2026-10-28T17:38:26+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-10-28T17:34:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Juniper Session Smart Router: unverified cache files let local users run code","impact":"high","summary":"PCLI in Juniper Session Smart Router and Session Smart Conductor processes model cache files without verifying their authenticity. An attacker who can write to the model cache directory can run arbitrary code and escalate privileges.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","session-smart-conductor","network-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"code runs as privileged user on the appliance","analyst_note":"Find the affected and fixed Junos Session Smart versions and the model cache path in the Juniper advisory; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-103402 gives no version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["cache-directory-not-writable-by-others"],"who_is_affected":"Operators running Juniper Session Smart Router or Session Smart Conductor where local users or processes can write to the PCLI model cache directory. unknown whether all versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000555,"input_tokens":3319,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Junos Session Smart versions and the model cache path in the Juniper advisory; NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-103402 gives no version data.","search":"'-103402':15A,18A '-2026':14A,17A 'access':91C 'allow':86C 'applianc':23B 'arbitrari':62B,99C 'attack':51B,88C 'authent':49B,72C 'cach':6A,44B,58B,95C,109C 'code':12A,63B,100C 'conductor':27B,41B,85C 'cve':13A,16A 'data':71C 'directori':59B,96C 'escal':65B,102C 'execut':98C 'file':7A,45B,110C 'infrastructur':19B 'insuffici':68C 'junip':1A,20B,34B,77C 'let':8A 'local':9A 'model':43B,57B,94C 'network':22B,78C 'network-appli':21B 'pcli':32B,75C 'privileg':66B,103C 'process':42B,106C 'router':4A,31B,37B,81C 'run':11A,61B 'session':2A,25B,29B,35B,39B,79C,83C 'session-smart-conductor':24B 'session-smart-rout':28B 'smart':3A,26B,30B,36B,40B,80C,84C 'unverifi':5A,108C 'user':10A 'verif':69C 'verifi':47B 'via':104C 'vulner':73C 'without':46B 'write':54B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running Juniper Session Smart Router or Session Smart Conductor. The flaw needs local write access to the PCLI model cache directory, so an attacker must already have a local account or foothold on the device. They can then run code and escalate privileges. Affected and fixed versions are not yet confirmed. Teams without these Juniper products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103402","severity":null,"published_at":"2026-10-28T17:17:24+00:00","modified_at":"2026-10-28T17:17:24+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103402:971","url":null,"severity":null,"published_at":"2026-10-28T17:38:26+00:00","modified_at":"2026-10-28T17:38:26+00:00","first_seen_at":"2026-10-28T17:38:26+00:00","fetched_at":"2026-10-28T17:38:26+00:00","note":"Juniper bulletin is JS-only (supportportal) and NVD empty via web-cli; no affected/fixed versions or cache path confirmed. CERT-FR AVI-1337 (JSA112528, 16 Oct) lists SSR <7.0.5, 7.1.x <7.1.7, 7.2.x <7.2.3 but names no CVE, so not applied. Nothing verified; no exploitation or PoC found. Sibling CVE-2026-103403 hit the same dead end."}],"documents":[{"id":11633,"url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/","title":"CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids)","kind":"other","source":"analyst","text":"Affected: SSR before 7.0.5; 7.1.x before 7.1.7; 7.2.x before 7.2.3. Source: Juniper JSA112528 of 16 Oct 2026. Does not name CVE-2026-103402.","published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":11640,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103402","title":"NVD: CVE-2026-103402","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}