CVE-2026-103407: Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Session Smart Router and Session Smart Conductorto a version that resolves this vulnerability.Fixed in 7.0.5 - Upgrade
Upgrade
Juniper Networks Session Smart Router and Session Smart Conductorto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
Juniper Networks Session Smart Router and Session Smart Conductorto a version that resolves this vulnerability.Fixed in 7.2.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated REST user can exploit it. The affected interface is the certificate and private-key REST API used by ConfigDirector PKI management.
What access does an attacker need?
The attacker needs valid authenticated REST access with low privileges; no user interaction is required. The vulnerability is remotely reachable over the network.
What could an attacker do?
An attacker can use unsanitized path input to read, overwrite, or delete arbitrary certificate and key files on the host filesystem. This can affect confidentiality, integrity, and availability.