---
id: "CVE-2026-103408"
kind: "vulnerability"
aliases: ["CVE-2026-103408"]
title: "Juniper Session Smart Router: DHCP client overflow allows remote code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Session Smart Router", "fixed": ["7.0.5", "7.1.7", "7.2.3"], "affected": "< 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3 (per CERT-FR for JSA112528, CVE mapping unconfirmed)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adjacent-network", "dhcp", "infrastructure", "juniper", "network-appliance", "sd-wan", "session-smart-router"]
not_affected_if: ["static-addressing-only"]
published_at: "2026-10-28T17:17:26+00:00"
first_seen_at: "2026-10-28T17:34:08+00:00"
updated_at: "2026-10-28T17:36:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103408", "first_seen_at": "2026-10-28T17:34:08+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:36:43+00:00"}]
---

# Juniper Session Smart Router: DHCP client overflow allows remote code execution

The DHCP client in Juniper Networks Session Smart Router has a stack buffer overflow. A malicious DHCP reply from the local network lets an unauthenticated attacker run code on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Session Smart Router affected < 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3 (per CERT-FR for JSA112528, CVE mapping unconfirmed) fixed 7.0.5, 7.1.7, 7.2.3

## How to check

Check the installed SSR version (e.g. 'show system version' on the router, or the Conductor GUI); versions older than 7.0.5 / 7.1.7 / 7.2.3 on their respective trains are in scope. Whether any SSR interface uses DHCP client mode matters; confirm in the JSA.

## Fix

Probable: upgrade SSR to 7.0.5, 7.1.7 or 7.2.3 (or later) per Juniper's 2026-10-16 patch notice; not yet confirmed against the CVE-specific advisory. No workaround listed.

## Timeline

- 2026-10-28T17:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103408
- 2026-10-28T17:36:43+00:00 analyst — Juniper's per-CVE advisory not yet readable (disclosure date 2026-10-28; portal pre-notice lists no CVEs). Vendor pre-notice (linked) says SSR/Conductor patch releases 7.0.5, 7.1.7, 7.2.3 shipped 2026-10-16 with critical fixes, no workaround; CERT-FR cites JSA112528. Mapping of this CVE to those releases is inferred, not confirmed; nothing marked verified. Recheck once the JSA is public.

## Documents

- [fix] On Demand: Session Smart Router (SSR) and Conductor patch release notification (HPE/Juniper, 2026-10-16) https://supportportal.juniper.net/s/article/On-Demand-Session-Smart-Router-SSR-and-Conductor-patch-release-notification
- [mentions] CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids) https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/

## From the sources

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_