Juniper Session Smart Router: Stack buffer overflow in DHCP client
Summary
A stack-based buffer overflow in the DHCP client of Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to execute code remotely by sending a malicious DHCP reply. No authentication is required, but the attacker must be on the same network segment as the router. The CNA rates the vulnerability CVSS 3.1 8.8, while VulDB rates it 10.0. Juniper SIRT is not aware of any malicious exploitation.
Affected
- Session Smart Router before 7.0.5
- Session Smart Router 7.1.0 to before 7.1.7
- Session Smart Router 7.2.0 to before 7.2.3
- The CNA states that the default configuration is unaffected.
Fixed in
- Upgrade to 7.0.5 or later in the 7.0 branch
- Upgrade to 7.1.7 or later in the 7.1 branch
- Upgrade to 7.2.3 or later in the 7.2 branch
Workaround
Unknown. The CNA record states that there are no known workarounds. Upgrading is the recommended fix.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Threat-intelligence aggregators list the vulnerability as not known to be exploited.
- Unverified: a public proof-of-concept is reportedly indexed online. It has not been verified.
Our recommendation
- Inventory all Session Smart Router units and their software versions.
- Upgrade to 7.0.5, 7.1.7 or 7.2.3 (or later), prioritising devices on shared, guest or otherwise untrusted network segments.
- Limit who can reach the segments where the routers' DHCP clients operate, and consider DHCP snooping on access switches.
- Check Juniper advisory JSA112183 and the NVD record for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Juniper Security Advisory JSA112183 supportportal.juniper.net
- Strix CVE record CVE-2026-103408 www.strix.ai
- Threatint CVE record CVE-2026-103408 cve.threatint.com
- OffSeq Radar CVE-2026-103408 radar.offseq.com
- VulDB entry 428049 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:30.
Original description (NVD)
A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.