{"id":"CVE-2026-103407","state":"PUBLISHED","title":"Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management","description":"An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.","publishedAt":"2026-10-28T16:36:19.559Z","updatedAt":"2026-10-28T16:36:19.559Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"juniper"},"assigner":"juniper","products":["Juniper Networks Session Smart Router","Juniper Networks Session Smart Conductor"],"affected":[{"vendor":"Juniper Networks","product":"Session Smart Router","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.0.5","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.7","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThan":"7.2.3","versionType":"custom"}]},{"vendor":"Juniper Networks","product":"Session Smart Conductor","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.0.5","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.7","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThan":"7.2.3","versionType":"custom"}]}],"references":["https://supportportal.juniper.net/JSA112183"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/103xxx/CVE-2026-103407.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-103407","state":"PUBLISHED","datePublished":"2026-10-28T16:36:19.559Z","dateUpdated":"2026-10-28T16:36:19.559Z","assignerShortName":"juniper","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateReserved":"2026-09-30T14:33:03.168Z"},"containers":{"cna":{"title":"Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management","descriptions":[{"lang":"en","value":"An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API."}],"affected":[{"vendor":"Juniper Networks","product":"Session Smart Router","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.0.5","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.7","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThan":"7.2.3","versionType":"custom"}]},{"vendor":"Juniper Networks","product":"Session Smart Conductor","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"7.0.5","versionType":"custom"},{"version":"7.1.0","status":"affected","lessThan":"7.1.7","versionType":"custom"},{"version":"7.2.0","status":"affected","lessThan":"7.2.3","versionType":"custom"}]}],"references":[{"url":"https://supportportal.juniper.net/JSA112183","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"juniper","orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","dateUpdated":"2026-10-28T16:36:19.559Z"},"datePublic":"2026-10-28T16:00:00.000Z","exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:<br><ul><li>7.0.5 \n\nand all subsequent releases;</li><li>7.1.7 \n\nand all subsequent releases;</li><li>7.2.3 and all subsequent releases.</li></ul>\n\n<br>"}],"value":"The following software releases of Session Smart Router and Session Smart Conductor have been updated to resolve these specific issues:\n  *  7.0.5 \n\nand all subsequent releases;\n  *  7.1.7 \n\nand all subsequent releases;\n  *  7.2.3 and all subsequent releases."}],"source":{"advisory":"JSA112183","defect":["I95-65210"],"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There are no known workarounds for this issue."}],"value":"There are no known workarounds for this issue."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}}}}}