{"id":"CVE-2026-103410","kind":"vulnerability","aliases":["CVE-2026-103410"],"related":[],"title":"Juniper Session Smart Router: crafted TLS certificate crashes the DPI scanner","description":"An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.","summary":"Integer overflow in the DPI certificate scanner of Juniper Session Smart Router lets a remote unauthenticated attacker crash it with a crafted TLS certificate. Juniper's JSA112528 lists patch releases 7.0.5, 7.1.7 and 7.2.3.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Session Smart Router","fixed":["7.0.5","7.1.7","7.2.3"],"affected":"< 7.0.5; 7.1.x < 7.1.7; 7.2.x < 7.2.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","infrastructure","juniper","network-appliance","session-smart-router"],"not_affected_if":["unknown"],"how_to_check":"Run the SSR version command (e.g. show system version on the router/Conductor) and compare to 7.0.5 / 7.1.7 / 7.2.3. Whether DPI certificate scanning is configured: unknown, not stated in the advisory.","fix":"Upgrade SSR/Conductor to the patch release for your branch: 7.0.5, 7.1.7 or 7.2.3 (JSA112528, covers the batch; per-CVE mapping not stated). No workaround per Juniper.","status":"open","published_at":"2026-10-28T17:17:28+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","triaged_at":"2026-10-28T17:34:29+00:00","updated_at":"2026-10-28T17:36:26+00:00","category":"infrastructure","confidence":0.55,"triage":{"at":"2026-10-28T17:34:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Juniper Session Smart Router: crafted TLS certificate crashes the DPI scanner","impact":"low","summary":"A integer overflow in the DPI certificate scanner of Juniper Session Smart Router lets an unauthenticated remote attacker trigger a denial of service. The attacker needs only to present a specially crafted TLS server certificate to traffic the router inspects.","category":"infrastructure","nicknames":[],"who_cares":["juniper","session-smart-router","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Router's DPI scanner crashes, causing denial of service on traffic path.","analyst_note":"Find the Juniper advisory (JSA) for CVE-2026-103410 to get affected and fixed versions and whether DPI certificate scanning is default-on.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Operators running Juniper Session Smart Router with DPI certificate scanning in its traffic path are the ones exposed. The sources do not list affected firmware versions or say whether scanning is on by default, so check the vendor advisory for the release train in use.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000559,"input_tokens":3298,"output_tokens":459,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Juniper advisory (JSA) for CVE-2026-103410 to get affected and fixed versions and whether DPI certificate scanning is default-on.","search":"'-103410':14A,17A '-2026':13A,16A '7.0.5':64B '7.1.7':65B '7.2.3':67B 'allow':83C 'applianc':29B 'attack':50B,87C 'caus':89C 'certif':7A,39B,57B,75C,100C 'craft':5A,55B,97C 'crash':8A,51B 'cve':12A,15A 'denial':22B,91C 'denial-of-servic':21B 'dpi':10A,38B,74C 'infrastructur':25B 'integ':34B,69C 'jsa112528':60B 'junip':1A,26B,42B,58B,78C 'let':46B 'list':61B 'network':28B,79C 'network-appli':27B 'overflow':35B,70C 'patch':62B 'releas':63B 'remot':48B,86C 'router':4A,20A,33B,45B,82C 'scanner':11A,40B,76C 'server':99C 'servic':24B,93C 'session':2A,18A,31B,43B,80C 'session-smart-rout':30B 'smart':3A,19A,32B,44B,81C 'special':96C 'tls':6A,56B,98C 'unauthent':49B,85C 'via':94C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Operators running Juniper Session Smart Router with DPI certificate scanning in its traffic path are the ones exposed. The sources do not list affected firmware versions or say whether scanning is on by default, so check the vendor advisory for the release train in use.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"sirt@juniper.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103410","severity":null,"published_at":"2026-10-28T17:17:28+00:00","modified_at":"2026-10-28T17:17:28+00:00","first_seen_at":"2026-10-28T17:34:08+00:00","fetched_at":"2026-10-28T17:34:08+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103410:965","url":null,"severity":null,"published_at":"2026-10-28T17:36:26+00:00","modified_at":"2026-10-28T17:36:26+00:00","first_seen_at":"2026-10-28T17:36:26+00:00","fetched_at":"2026-10-28T17:36:26+00:00","note":"Juniper JSA112528 (read via browser) lists patch releases 7.0.5, 7.1.7, 7.2.3 for all SSR/Conductor, disclosure date Oct 28; it names no CVEs, so mapping to this CVE and DPI default-on status are unconfirmed. Nothing marked verified. No exploitation or PoC found."}],"documents":[{"id":11634,"url":"https://supportportal.juniper.net/s/article/On-Demand-Session-Smart-Router-SSR-and-Conductor-patch-release-notification","title":"On Demand: Session Smart Router (SSR) and Conductor patch release notification (HPE/Juniper, 2026-10-16)","kind":"vendor","source":"analyst","text":"Vendor pre-notification: patch releases SSR/Conductor 7.0.5, 7.1.7, 7.2.3 available as of 2026-10-16 with critical security fixes; vulnerabilities publicly disclosed 2026-10-28. Affects all versions of SSR and Conductor. Workaround: N/A. Does not list individual CVEs.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":11633,"url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1337/","title":"CERT-FR AVI-1337: Juniper SSR (cites JSA112528, 16 Oct 2026; no CVE ids)","kind":"other","source":"analyst","text":"Affected: SSR before 7.0.5; 7.1.x before 7.1.7; 7.2.x before 7.2.3. Source: Juniper JSA112528 of 16 Oct 2026. Does not name CVE-2026-103402.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}