Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-103407

Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
juniper

Description

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Juniper Networks Session Smart Router

Default version status: unaffected

  • 0 to < 7.0.5affected
  • 7.1.0 to < 7.1.7affected
  • 7.2.0 to < 7.2.3affected

Juniper Networks Session Smart Conductor

Default version status: unaffected

  • 0 to < 7.0.5affected
  • 7.1.0 to < 7.1.7affected
  • 7.2.0 to < 7.2.3affected

References