CVE-2026-103401
Awaiting Analysis
Awaiting Analysis - Queue
Improper Link Resolution Leading to File Overwrite in Juniper Session Smart Router
Vulnerability report for CVE-2026-103401, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: Juniper Networks, Inc.
Description
Description
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints.
This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Juniper Networks | Session Smart Router | 0 |
| Juniper Networks | Session Smart Router | 7.1.0 |
| Juniper Networks | Session Smart Router | 7.2.0 |
| Juniper Networks | Session Smart Conductor | 0 |
| Juniper Networks | Session Smart Conductor | 7.1.0 |
| Juniper Networks | Session Smart Conductor | 7.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
