Juniper Session Smart Router: Path traversal in certificate REST API
Summary
Juniper Session Smart Router and Session Smart Conductor contain a path traversal flaw (CWE-22) in the ConfigDirector component. An authenticated REST user can use the certificate and private-key API to read, overwrite or delete arbitrary certificate and key files on the host. Compromised keys could enable interception of management or tunnel traffic, and deleted files could break the device's TLS identity and cause an outage.
Affected
- Session Smart Router: versions before 7.0.5; 7.1.0 to before 7.1.7; 7.2.0 to before 7.2.3
- Session Smart Conductor: versions before 7.0.5; 7.1.0 to before 7.1.7; 7.2.0 to before 7.2.3
Fixed in
- Session Smart Router and Session Smart Conductor 7.0.5 and all later releases
- Session Smart Router and Session Smart Conductor 7.1.7 and all later releases
- Session Smart Router and Session Smart Conductor 7.2.3 and all later releases
Workaround
Unknown. The vendor's CNA record states there are no known workarounds. Restricting access to the management interface is an interim measure recommended by the research, not a vendor statement.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
- Not listed as known exploited (CISA KEV) in the secondary sources reviewed.
- No public proof of concept found.
- EPSS: 0.23 % (low).
Our recommendation
- Upgrade Session Smart Router and Session Smart Conductor to the fixed release for your branch (7.0.5, 7.1.7 or 7.2.3 and later).
- Until patched, restrict access to the management/REST interface to administrative networks.
- Limit REST accounts to the minimum needed and review them regularly.
- Back up certificates and keys and monitor for unexpected changes or deletions.
- Prioritise patching if the management interface is reachable from untrusted networks. Confirm versions in Juniper advisory JSA112183.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper advisory JSA112183 supportportal.juniper.net
- Strix CVE-2026-103407 www.strix.ai
- OffSeq Radar CVE-2026-103407 radar.offseq.com
- VulDB entry 428035 vuldb.com
- Mallory summary of JSA112183 mallory.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:28.
Original description (NVD)
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.