Juniper Session Smart Router: Missing authentication for critical function
Summary
Juniper Session Smart Router (SSR) contains a missing authentication flaw in an internal endpoint that runs as root. An unauthenticated attacker on the network can send crafted URL parameters to obtain administrative privileges on the router. The issue can only be exploited before the device is onboarded to Mist or Conductor; once onboarded, it is no longer exploitable.
Affected
- Session Smart Router before 7.0.5
- Session Smart Router 7.1.0 to before 7.1.7
- Session Smart Router 7.2.0 to before 7.2.3
- Exact fixed build numbers and any covered maintenance releases: check Juniper advisory JSA112183
Fixed in
- 7.0.5 and later
- 7.1.7 and later
- 7.2.3 and later
Workaround
- No known workarounds from the vendor.
- Onboard devices to Mist or Conductor promptly, as this closes the exploit path according to the CVE description.
- Keep unclaimed devices off untrusted networks and out of reach from the internet.
Exploitation
- Juniper SIRT is not aware of any malicious exploitation.
- Not listed as known exploited in the sources checked; CISA KEV was not directly verified.
- No verified public proof of concept found.
Our recommendation
- Inventory all Session Smart Router devices and their firmware versions.
- Upgrade to 7.0.5, 7.1.7, 7.2.3 or later, after checking JSA112183 for exact builds.
- Ensure that devices not yet onboarded to Mist or Conductor are not reachable from untrusted networks and are claimed promptly.
- Verify whether any router was deployed in the pre-onboarding state and review its configuration and admin accounts.
- Monitor for unexpected administrative access on routers.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Hunt-Benito/the-unguarded-first-day-cve-2026-103409-juniper-session-smart-router
Research sources
- Juniper Security Advisory JSA112183 supportportal.juniper.net
- Strix CVE-2026-103409 www.strix.ai
- OffSeq Radar CVE-2026-103409 radar.offseq.com
- ThreatInt CVE-2026-103409 cve.threatint.com
- SecurityOnline: Juniper Session Smart Router vulnerabilities securityonline.info
- Xalgorix weekly AppSec threat digest Oct 23-30 2026 xalgorix.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:12.
Original description (NVD)
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.