{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-462","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-30T13:15:45Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"An out-of-bounds read vulnerability and malformed HTTP URI in Juniper Networks Session Smart Router and Session Smart Conductor can be exploited via crafted HTTP requests to cause denial of service by triggering service crashes during HTTP application identification.","supportingMedia":null},{"lang":"nl","value":"An out-of-bounds write vulnerability in Juniper Networks Session Smart Router's TCP proxy path allows attackers to corrupt packet data and potentially crash the data plane via a crafted TCP option length.","supportingMedia":null},{"lang":"nl","value":"An out-of-bounds write vulnerability in Juniper Networks Session Smart Router's TCP header processing allows attackers to corrupt TCP payload data and cause session desynchronization via a transit TCP packet with an oversized SACK option length when TCP sequence stitching is enabled.","supportingMedia":null},{"lang":"nl","value":"An out-of-bounds read vulnerability in the VRRPv3 implementation of Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory or cause a system fault via crafted VRRP advertisements.","supportingMedia":null},{"lang":"nl","value":"An improper initialization vulnerability in Juniper Networks Session Smart Router SSR software causes incorrect encryption keys during security policy updates, enabling traffic decryption or denial of service.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ember service allows local attackers to unmount arbitrary filesystems or cause denial of service by creating specially crafted directory names and restarting the service.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor allows local unprivileged users to overwrite arbitrary files as root via unauthenticated API endpoints, affecting Mist-managed and unmanaged routers.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor allows attackers with write access to the model cache directory to execute arbitrary code and escalate privileges due to lack of integrity verification.","supportingMedia":null},{"lang":"nl","value":"An OS Command Injection vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's AccessManager allows attackers to execute arbitrary commands and delete files by exploiting unvalidated input during audit rule deletion.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Conductor's RoutingManager involves insecure file permissions that allow local users unauthorized access to sensitive routing credentials.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor allows HTTP response splitting via injection of arbitrary HTTP headers through unsanitized request body parameters.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Conductor's AutomatedProvisioner allows unauthenticated remote attackers to execute arbitrary root commands via specially crafted salt minion IDs during key management.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ConfigDirector allows authenticated REST users to manipulate certificate and key files on the host filesystem via unsanitized input in the certificate and private-key REST API, enabling arbitrary file read, overwrite, or deletion.","supportingMedia":null},{"lang":"nl","value":"A stack buffer overflow vulnerability in Juniper Networks Session Smart Router's DHCP client allows unauthenticated local attackers to execute remote code via malicious DHCP replies containing crafted DHCP options.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router allows unauthenticated attackers to gain administrative privileges by exploiting an insecure internal endpoint prior to device onboarding to Mist/Conductor.","supportingMedia":null},{"lang":"nl","value":"An integer overflow vulnerability in the DPI certificate scanner of Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.","supportingMedia":null},{"lang":"nl","value":"An Integer Underflow vulnerability in Juniper Networks Session Smart Router's DhcpMessageDecoder allows a local attacker to cause information disclosure and denial of service via a malicious DHCP reply during DHCP option parsing.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's AccessManager allows attackers with config-write privileges to execute arbitrary root commands and escalate privileges via improper validation in YANG configuration updates.","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0462.json","name":"","tags":["advisory"]},{"url":"https://supportportal.juniper.net/s/article/2026-10-On-Demand-Security-Bulletin-Session-Smart-Router-and-Session-Smart-Conductor-Multiple-internally-discovered-vulnerabilities-resolved","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103390.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103391.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103392.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103393.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103394.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103400.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103401.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103402.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103403.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103404.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103405.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103406.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103407.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103408.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103409.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103410.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103411.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-106079.json","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Out-of-bounds Read","cweId":"CWE-125","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Out-of-bounds Write","cweId":"CWE-787","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Link Resolution Before File Access ('Link Following')","cweId":"CWE-59","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","cweId":"CWE-78","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Incorrect Permission Assignment for Critical Resource","cweId":"CWE-732","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","cweId":"CWE-22","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Stack-based Buffer Overflow","cweId":"CWE-121","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Authentication for Critical Function","cweId":"CWE-306","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Integer Overflow or Wraparound","cweId":"CWE-190","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Integer Underflow (Wrap or Wraparound)","cweId":"CWE-191","type":"CWE"}]}],"affected":[{"vendor":"Juniper Networks","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-103390","CVE-2026-103391","CVE-2026-103392","CVE-2026-103393","CVE-2026-103394","CVE-2026-103400","CVE-2026-103401","CVE-2026-103402","CVE-2026-103403","CVE-2026-103404","CVE-2026-103405","CVE-2026-103406","CVE-2026-103407","CVE-2026-103408","CVE-2026-103409","CVE-2026-103410","CVE-2026-103411","CVE-2026-106079"]}},"adp":null}}