Juniper patches 19 flaws in Session Smart Router
Juniper fixed 19 vulnerabilities in Session Smart Router and Session Smart Conductor, including unauthenticated root-level remote code execution rated up to CVSS 9.8.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 18 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory summarizing 19 vulnerabilities patched by Juniper Networks in its Session Smart Router (SSR) and Session Smart Conductor products. The flaws span multiple components including the HTTP parser, TCP proxy, VRRPv3 handling, DHCP client, AccessManager, RoutingManager, ConfigDirector, and AutomatedProvisioner. Impacts range from service crashes, memory corruption and information disclosure to unauthenticated remote command execution as root, privilege escalation, arbitrary file read/write/delete, and OS command injection via crafted salt minion IDs or YANG configuration input.
Most severe among these are an unauthenticated API endpoint allowing local unprivileged users to overwrite arbitrary files as root, an insecure internal endpoint granting unauthenticated attackers administrative privileges, a stack-based buffer overflow in the DHCP client enabling remote code execution, and an AutomatedProvisioner flaw permitting unauthenticated remote command execution as root via crafted salt minion IDs (CVSS up to 9.8). Additional issues include decryption weaknesses from improper security-policy initialization, HTTP response splitting, insufficient file permission controls exposing routing data, and an integer overflow in the DPI TLS certificate scanner causing denial of service.
No in-the-wild exploitation is reported. Juniper has released updates addressing all listed CVEs; defenders running Session Smart Router or Session Smart Conductor should prioritize patching given the number of high/critical-rated issues (several CVSS 8.8–9.8) and the presence of unauthenticated remote code execution and privilege escalation vectors affecting critical network infrastructure.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0462.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs