Live › vulnerability › CVE-2026-103408
Go to dashboardThe DHCP client in Juniper Networks Session Smart Router has a stack buffer overflow. A malicious DHCP reply from the local network lets an unauthenticated attacker run code on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 17:34 UTC. All times on this page are UTC.
Teams running Juniper/HPE Session Smart Router (SSR) SD-WAN routers, most of all those with an interface set to get its address by DHCP client. An attacker on the same local network segment who can send a DHCP reply could run code on the router without logging in. Routers with only static addressing may be out of reach, but the vendor has not said so yet; managed Mist/WAN Assurance routers are upgraded through Mist or Conductor.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Session Smart Router | vendor | < 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3 (per CERT-FR for JSA112528, CVE mapping unconfirmed) | 7.0.5, 7.1.7, 7.2.3 |
show system version on the router, or the Conductor GUI); versions older than 7.0.5 / 7.1.7 / 7.2.3 on their respective trains are in scope7.0.5, 7.1.7 or 7.2.3 (or later) per Juniper's 2026-10-16 patch notice; not yet confirmed against the CVE-specific advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.
This page as .md · .json · in your agent: get_signal("CVE-2026-103408")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.