Juniper Session Smart Router: Unverified cache files allow code execution
Summary
Juniper Session Smart Router and Session Smart Conductor process cache files without verifying their authenticity (CWE-345). An attacker with write access to the model cache directory can execute arbitrary code and escalate privileges on the device. The attacker needs an existing foothold or privileged access, so this is not an unauthenticated internet entry point.
Affected
- Session Smart Router before 7.0.5
- Session Smart Router 7.1.0 before 7.1.7
- Session Smart Router 7.2.0 before 7.2.3
- Session Smart Conductor before 7.0.5
- Session Smart Conductor 7.1.0 before 7.1.7
- Session Smart Conductor 7.2.0 before 7.2.3
Fixed in
- Session Smart Router and Conductor 7.0.5 and later
- Session Smart Router and Conductor 7.1.7 and later
- Session Smart Router and Conductor 7.2.3 and later
- Verify the exact versions in Juniper advisory JSA112183 before rollout.
Workaround
- No known workarounds.
- Interim hardening: restrict write access to the model cache directory and limit access to management interfaces.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- No public exploit known (VulDB).
- EPSS: 0.2 % (percentile 9).
- CISA KEV status not verified.
Our recommendation
- Check whether Session Smart Router or Conductor devices are in use and which software release they run.
- Patch to the fixed release from JSA112183, together with the other flaws in the same bulletin.
- Restrict device administration and cache directory write access until patching is complete.
- Monitor for unexpected changes to cache files and device configuration.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112183 supportportal.juniper.net
- Strix CVE-2026-103402 www.strix.ai
- ThreatInt CVE-2026-103402 cve.threatint.com
- VulDB CVE-2026-103402 vuldb.com
- CVE Brief advisory summary cvebrief.com
- Mallory analysis of the Session Smart bulletin mallory.ai
- SecurityOnline Session Smart vulnerabilities securityonline.info
- Juniper Session Smart Router product page www.juniper.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:31.
Original description (NVD)
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.