Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN1110 _____________________________________________________________________ DATE : 30/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Session Smart Router and Session Smart Conductor versions prior to 7.0.5, 7.1.7, 7.2.3. ==================================================================== https://supportportal.juniper.net/s/article/2026-10-On-Demand-Security-Bulletin-Session-Smart-Router-and-Session-Smart-Conductor-Multiple-internally-discovered-vulnerabilities-resolved _____________________________________________________________________ 2026-10 On-Demand Security Bulletin: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolved Article ID JSA112183 Created 2026-10-28 Last Updated 2026-10-28 Product Affected These issues affect all versions of Session Smart Router. These issues affect all versions of Session Smart Conductor. Severity Critical Severity Assessment (CVSS) Score CVSS: v3.1: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Problem Multiple vulnerabilities have been resolved in Juniper Networks Session Smart Router and Session Smart Conductor 7.0.5, 7.1.7, and 7.2.3 as a result of extensive internal testing of the software. These issues affect all versions of Session Smart Router and Session Smart Conductor before 7.0.5, 7.1.7, and 7.2.3. Important security issues resolved include: CVE CVSS Summary CVE-2026-103390 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification CVE-2026-103391 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature CVE-2026-103392 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled CVE-2026-103393 4.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing CVE-2026-103394 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates. CVE-2026-103400 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup CVE-2026-103401 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root CVE-2026-103402 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation CVE-2026-103403 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules CVE-2026-103404 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials CVE-2026-103405 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting CVE-2026-103406 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. CVE-2026-103407 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management CVE-2026-103408 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options CVE-2026-103409 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed CVE-2026-103410 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection CVE-2026-103411 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing CVE-2026-106079 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities. These issues were found during internal product security testing or research. Solution The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues: 7.0.5 and all subsequent releases 7.1.7 and all subsequent releases 7.2.3 and all subsequent releases Note: Juniper SIRT's policy is not to evaluate releases that are beyond End of Engineering (EOE) or End of Life (EOL). Workaround There are no known workarounds for all of these issues. Refer to the specific CVE records for additional details on potential individual workarounds. Severity Assessment Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories." Modification History 2026-10-28: Initial Publication Related Information KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process KB16765: In which releases are vulnerabilities fixed? KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team www.cve.org/CVERecord?id=CVE-2026-103390 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103391 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103392 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103393 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103394 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103400 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103401 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103402 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103403 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103404 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103405 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103406 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103407 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103408 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103409 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103410 vdb-entry www.cve.org/CVERecord?id=CVE-2026-103411 vdb-entry www.cve.org/CVERecord?id=CVE-2026-106079 vdb-entry ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================