CVE-2026-103408: Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options

Published Oct 28, 2026

Updated

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

Affected Software

1 affected component

Juniper Networks Session Smart Router

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Juniper Networks Session Smart Router to a version that resolves this vulnerability.
Fixed in 7.0.5
Upgrade
Upgrade Juniper Networks Session Smart Router to a version that resolves this vulnerability.
Fixed in 7.1.7
Upgrade
Upgrade Juniper Networks Session Smart Router to a version that resolves this vulnerability.
Fixed in 7.2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·04:36 PM

Data Sourced

via MITRE·04:36 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker on the local network can exploit it by sending a malicious DHCP reply to the affected DHCP client.

What level of impact could successful exploitation have?

Successful exploitation can result in remote code execution. The provided metrics indicate high impact to confidentiality, integrity, and availability.