{"id":"CVE-2026-103409","kind":"vulnerability","aliases":["CVE-2026-103409"],"related":[],"title":"Juniper Session Smart Router: unauthenticated network attacker gains admin via URL parameters","description":"A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.\n\nNote that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.","summary":"Juniper Session Smart Router has an endpoint that runs as root and skips authentication, so a network attacker can send crafted URL parameters to gain administrative privileges. The flaw can only be exploited before the device is onboarded to Mist/Conductor, and not after.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","juniper","mist-conductor","network-appliance","session-smart-router"],"not_affected_if":["onboarded-to-mist-conductor"],"how_to_check":"- Check whether the router is onboarded to Mist/Conductor; the sources say exploitation is no longer possible after onboarding\n- Check the Session Smart Router software version against the fixed release in Juniper's advisory (unknown in these sources)","fix":"- Onboard the device to Mist/Conductor, which the sources say removes the exploit path\n- Apply the fixed Session Smart Router release from Juniper's advisory (version unknown in these sources)","status":"open","published_at":"2026-10-28T17:17:27+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:15+00:00","updated_at":"2026-10-28T17:34:15+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T17:34:15Z","model":"claude-haiku-5-5","output":{"fix":"- Onboard the device to Mist/Conductor, which the sources say removes the exploit path\n- Apply the fixed Session Smart Router release from Juniper's advisory (version unknown in these sources)","reach":"network","title":"Juniper Session Smart Router: unauthenticated network attacker gains admin via URL parameters","impact":"high","summary":"Juniper Session Smart Router has an endpoint that runs as root and skips authentication, so a network attacker can send crafted URL parameters to gain administrative privileges. The flaw can only be exploited before the device is onboarded to Mist/Conductor, and not after.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","network-appliance","mist-conductor"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker gains administrative control of the router as root","analyst_note":"Find Juniper's advisory for the affected and fixed Session Smart Router versions and the exact pre-onboarding condition; NVD alone gives no version data.","how_to_check":"- Check whether the router is onboarded to Mist/Conductor; the sources say exploitation is no longer possible after onboarding\n- Check the Session Smart Router software version against the fixed release in Juniper's advisory (unknown in these sources)","needs_analyst":true,"not_affected_if":["onboarded-to-mist-conductor"],"who_is_affected":"Owners of Juniper Session Smart Router devices that have not yet been onboarded to Mist/Conductor and are reachable from the network. Devices already onboarded to Mist/Conductor are stated to be no longer exploitable, so they can skip the urgent response.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000647,"input_tokens":3360,"output_tokens":621,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-103409':15A,18A '-2026':14A,17A 'admin':9A 'administr':56B,93C 'allow':84C 'applianc':26B 'attack':7A,48B,90C 'authent':44B,73C 'base':89C 'conductor':23B 'craft':51B,97C 'critic':75C 'cve':13A,16A 'devic':66B,118C,132C 'endpoint':37B,103C 'exploit':63B,114C,129C 'flaw':59B 'function':76C 'gain':8A,55B 'infrastructur':19B 'insecur':102C 'issu':124C 'junip':1A,20B,31B,79C 'longer':127C 'miss':72C 'mist':22B 'mist-conductor':21B 'mist/conductor':70B,122C,136C 'network':6A,25B,47B,80C,88C 'network-appli':24B 'network-bas':87C 'note':107C 'obtain':92C 'onboard':68B,120C,134C 'paramet':12A,53B,99C 'pass':96C 'prior':115C 'privileg':57B,94C 'root':41B,106C 'router':4A,30B,34B,83C 'run':39B,104C 'send':50B 'session':2A,28B,32B,81C 'session-smart-rout':27B 'skip':43B 'smart':3A,29B,33B,82C 'unauthent':5A,86C 'url':11A,52B,98C 'via':10A 'vulner':77C,110C","nicknames":[],"mitigations":[],"who_affected":"Owners of Juniper Session Smart Router devices that have not yet been onboarded to Mist/Conductor and are reachable from the network. Devices already onboarded to Mist/Conductor are stated to be no longer exploitable, so they can skip the urgent response.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103409","severity":null,"published_at":"2026-10-28T17:17:27+00:00","modified_at":"2026-10-28T17:17:28+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}