{"id":"CVE-2026-103408","kind":"vulnerability","aliases":["CVE-2026-103408"],"related":[],"title":"Juniper Session Smart Router: DHCP client overflow allows remote code execution","description":"A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.","summary":"The DHCP client in Juniper Networks Session Smart Router has a stack buffer overflow. A malicious DHCP reply from the local network lets an unauthenticated attacker run code on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Session Smart Router","fixed":["7.0.5","7.1.7","7.2.3"],"affected":"< 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3 (per CERT-FR for JSA112528, CVE mapping unconfirmed)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adjacent-network","dhcp","infrastructure","juniper","network-appliance","sd-wan","session-smart-router"],"not_affected_if":["static-addressing-only"],"how_to_check":"Check the installed SSR version (e.g. 'show system version' on the router, or the Conductor GUI); versions older than 7.0.5 / 7.1.7 / 7.2.3 on their respective trains are in scope. Whether any SSR interface uses DHCP client mode matters; confirm in the JSA.","fix":"Probable: upgrade SSR to 7.0.5, 7.1.7 or 7.2.3 (or later) per Juniper's 2026-10-16 patch notice; not yet confirmed against the CVE-specific advisory. No workaround listed.","status":"open","published_at":"2026-10-28T17:17:26+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:18+00:00","updated_at":"2026-10-28T17:36:43+00:00","category":"infrastructure","confidence":0.45,"triage":{"at":"2026-10-28T17:34:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Juniper Session Smart Router: DHCP client overflow allows remote code execution","impact":"high","summary":"The DHCP client in Juniper Networks Session Smart Router has a stack buffer overflow. A malicious DHCP reply from the local network lets an unauthenticated attacker run code on the device.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","dhcp","network-appliance"],"confidence":0.5,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the router via DHCP reply","analyst_note":"Find Juniper's advisory for CVE-2026-103408 to get affected and fixed versions and the check commands; the sources only give the NVD description.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["static-addressing-only"],"who_is_affected":"Teams running Juniper Session Smart Routers that take a DHCP address on an interface reachable by other hosts on the local network. Devices with static addressing only, and networks where DHCP replies cannot be injected, are less exposed. The sources do not list affected or fixed versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000553,"input_tokens":3298,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Juniper's advisory for CVE-2026-103408 to get affected and fixed versions and the check commands; the sources only give the NVD description.","search":"'-103408':14A,17A '-2026':13A,16A 'achiev':92C 'adjac':22B 'adjacent-network':21B 'allow':8A,83C 'applianc':29B 'attack':62B,86C 'buffer':49B,70C 'client':6A,39B,76C 'code':10A,64B,94C 'cve':12A,15A 'devic':67B 'dhcp':5A,24B,38B,53B,75C,99C 'execut':11A,95C 'infrastructur':25B 'junip':1A,26B,41B,78C 'let':59B 'local':57B,89C 'malici':52B,98C 'network':23B,28B,42B,58B,79C,90C 'network-appli':27B 'overflow':7A,50B,71C 'remot':9A,93C 'repli':54B,100C 'router':4A,20A,36B,45B,82C 'run':63B 'sd':31B 'sd-wan':30B 'session':2A,18A,34B,43B,80C 'session-smart-rout':33B 'smart':3A,19A,35B,44B,81C 'stack':48B,69C 'unauthent':61B,85C 'via':96C 'vulner':72C 'wan':32B","nicknames":[],"mitigations":[],"who_affected":"Teams running Juniper/HPE Session Smart Router (SSR) SD-WAN routers, most of all those with an interface set to get its address by DHCP client. An attacker on the same local network segment who can send a DHCP reply could run code on the router without logging in. Routers with only static addressing may be out of reach, but the vendor has not said so yet; managed Mist/WAN Assurance routers are upgraded through Mist or Conductor.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103408","severity":null,"published_at":"2026-10-28T17:17:26+00:00","modified_at":"2026-10-28T17:17:27+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103408:966","url":null,"severity":null,"published_at":"2026-10-28T17:36:43+00:00","modified_at":"2026-10-28T17:36:43+00:00","first_seen_at":"2026-10-28T17:36:43+00:00","fetched_at":"2026-10-28T17:36:43+00:00","note":"Juniper's per-CVE advisory not yet readable (disclosure date 2026-10-28; portal pre-notice lists no CVEs). Vendor pre-notice (linked) says SSR/Conductor patch releases 7.0.5, 7.1.7, 7.2.3 shipped 2026-10-16 with critical fixes, no workaround; CERT-FR cites JSA112528. Mapping of this CVE to those releases is inferred, not confirmed; nothing marked verified. Recheck once the JSA is public."}],"documents":[{"id":11634,"url":"https://supportportal.juniper.net/s/article/On-Demand-Session-Smart-Router-SSR-and-Conductor-patch-release-notification","title":"On Demand: Session Smart Router (SSR) and Conductor patch release notification (HPE/Juniper, 2026-10-16)","kind":"vendor","source":"analyst","text":"Vendor pre-notification: patch releases SSR/Conductor 7.0.5, 7.1.7, 7.2.3 available as of 2026-10-16 with critical security fixes; vulnerabilities publicly disclosed 2026-10-28. Affects all versions of SSR and Conductor. Workaround: N/A. Does not list individual CVEs.","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":11633,"url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/","title":"CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids)","kind":"other","source":"analyst","text":"Affected: SSR before 7.0.5; 7.1.x before 7.1.7; 7.2.x before 7.2.3. Source: Juniper JSA112528 of 16 Oct 2026. Does not name CVE-2026-103402.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}