{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Juniper heeft meerdere kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden betreffen verschillende componenten van de Juniper Networks Session Smart Router en Session Smart Conductor.\n- Er zijn out-of-bounds read- en write-fouten in HTTP-parser, TCP proxy, TCP header verwerking en VRRPv3 packet verwerking, die kunnen leiden tot service crashes, geheugenbeschadiging, sessie desynchronisatie en mogelijke informatielekken.\n- Een improper initialisatieprobleem in de beveiligingspolicy kan leiden tot het gebruik van onjuiste encryptiesleutels, wat decryptie van netwerkverkeer of denial of service kan veroorzaken.\n- Verder kunnen lokale aanvallers door speciaal vervaardigde directorynamen onbedoeld bestanden unmounten tijdens service cleanup, wat de beschikbaarheid beïnvloedt.\n- Ongeauthenticeerde API endpoints maken het mogelijk voor lokale niet-geprivilegieerde gebruikers om als root willekeurige bestanden te overschrijven.\n- Onvoldoende verificatie van data-integriteit in de model cache directory kan leiden tot het uitvoeren van willekeurige code en privilege escalatie.\n- In de AccessManager module is er een OS command injection mogelijk via ongeldige invoer bij het verwijderen van auditregels, wat ook het verwijderen van bestanden mogelijk maakt.\n- Onjuiste bestandspermissies in de RoutingManager module van Session Smart Conductor kunnen lokale gebruikers toegang geven tot gevoelige routinggegevens.\n- Ongefilterde invoer in request body parameters maakt HTTP response splitting mogelijk.\n- De AutomatedProvisioner van Session Smart Conductor bevat een kwetsbaarheid die ongeauthenticeerde remote command execution als root toestaat via speciaal vervaardigde salt minion IDs.\n- In de ConfigDirector component kunnen geauthenticeerde REST gebruikers via ongesaniteerde invoer in certificaat- en private key API's willekeurige bestandsoperaties uitvoeren, waaronder lezen, overschrijven en verwijderen.\n- Een stack buffer overflow in de DHCP client van Session Smart Router kan leiden tot remote code execution.\n- Een onbeveiligde interne endpoint in Session Smart Router maakt het mogelijk voor ongeauthenticeerde aanvallers om administratieve privileges te verkrijgen.\n- Een integer overflow in de Deep Packet Inspection certificate scanner kan een denial of service veroorzaken bij het inspecteren van TLS certificaten.\n- Een integer underflow in de DhcpMessageDecoder kan leiden tot informatielekken en service crashes.\n- Tenslotte kunnen in de AccessManager component met config-write rechten OS command injection en privilege escalatie plaatsvinden door onvoldoende validatie en neutralisatie van invoer in YANG configuraties.", "title": "Interpretaties" }, { "category": "description", "text": "Juniper heeft updates uitgebracht om de kwetsbaarheden in Juniper Networks Session Smart Router en Session Smart Conductor te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "general", "text": "Improper Link Resolution Before File Access ('Link Following')", "title": "CWE-59" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "general", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "general", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Loop with Unreachable Exit Condition ('Infinite Loop')", "title": "CWE-835" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://supportportal.juniper.net/s/article/2026-10-On-Demand-Security-Bulletin-Session-Smart-Router-and-Session-Smart-Conductor-Multiple-internally-discovered-vulnerabilities-resolved" } ], "title": "Kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor", "tracking": { "current_release_date": "2026-10-30T13:15:45.991474Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0462", "initial_release_date": "2026-10-30T13:15:45.991474Z", "revision_history": [ { "date": "2026-10-30T13:15:45.991474Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Session Smart Conductor" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "Session Smart Router" } ], "category": "vendor", "name": "Juniper Networks" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-103390", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability and malformed HTTP URI in Juniper Networks Session Smart Router and Session Smart Conductor can be exploited via crafted HTTP requests to cause denial of service by triggering service crashes during HTTP application identification.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103390 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103390.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103390" }, { "cve": "CVE-2026-103391", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability in Juniper Networks Session Smart Router's TCP proxy path allows attackers to corrupt packet data and potentially crash the data plane via a crafted TCP option length.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103391 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103391.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103391" }, { "cve": "CVE-2026-103392", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "An out-of-bounds write vulnerability in Juniper Networks Session Smart Router's TCP header processing allows attackers to corrupt TCP payload data and cause session desynchronization via a transit TCP packet with an oversized SACK option length when TCP sequence stitching is enabled.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103392 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103392.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 4.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103392" }, { "cve": "CVE-2026-103393", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "other", "text": "Out-of-bounds Read", "title": "CWE-125" }, { "category": "description", "text": "An out-of-bounds read vulnerability in the VRRPv3 implementation of Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory or cause a system fault via crafted VRRP advertisements.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103393 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103393.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103393" }, { "cve": "CVE-2026-103394", "notes": [ { "category": "description", "text": "An improper initialization vulnerability in Juniper Networks Session Smart Router SSR software causes incorrect encryption keys during security policy updates, enabling traffic decryption or denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103394 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103394.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 3.7, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103394" }, { "cve": "CVE-2026-103400", "notes": [ { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ember service allows local attackers to unmount arbitrary filesystems or cause denial of service by creating specially crafted directory names and restarting the service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103400 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103400.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103400" }, { "cve": "CVE-2026-103401", "cwe": { "id": "CWE-59", "name": "Improper Link Resolution Before File Access ('Link Following')" }, "notes": [ { "category": "other", "text": "Improper Link Resolution Before File Access ('Link Following')", "title": "CWE-59" }, { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor allows local unprivileged users to overwrite arbitrary files as root via unauthenticated API endpoints, affecting Mist-managed and unmanaged routers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103401 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103401.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103401" }, { "cve": "CVE-2026-103402", "notes": [ { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor allows attackers with write access to the model cache directory to execute arbitrary code and escalate privileges due to lack of integrity verification.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103402 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103402.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103402" }, { "cve": "CVE-2026-103403", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "An OS Command Injection vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's AccessManager allows attackers to execute arbitrary commands and delete files by exploiting unvalidated input during audit rule deletion.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103403 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103403.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103403" }, { "cve": "CVE-2026-103404", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "notes": [ { "category": "other", "text": "Incorrect Permission Assignment for Critical Resource", "title": "CWE-732" }, { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Conductor's RoutingManager involves insecure file permissions that allow local users unauthorized access to sensitive routing credentials.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103404 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103404.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103404" }, { "cve": "CVE-2026-103405", "notes": [ { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor allows HTTP response splitting via injection of arbitrary HTTP headers through unsanitized request body parameters.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103405 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103405.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103405" }, { "cve": "CVE-2026-103406", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Conductor's AutomatedProvisioner allows unauthenticated remote attackers to execute arbitrary root commands via specially crafted salt minion IDs during key management.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103406 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103406.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103406" }, { "cve": "CVE-2026-103407", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's ConfigDirector allows authenticated REST users to manipulate certificate and key files on the host filesystem via unsanitized input in the certificate and private-key REST API, enabling arbitrary file read, overwrite, or deletion.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103407 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103407.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103407" }, { "cve": "CVE-2026-103408", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "A stack buffer overflow vulnerability in Juniper Networks Session Smart Router's DHCP client allows unauthenticated local attackers to execute remote code via malicious DHCP replies containing crafted DHCP options.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103408 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103408.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103408" }, { "cve": "CVE-2026-103409", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "other", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router allows unauthenticated attackers to gain administrative privileges by exploiting an insecure internal endpoint prior to device onboarding to Mist/Conductor.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103409 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103409.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103409" }, { "cve": "CVE-2026-103410", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "other", "text": "Loop with Unreachable Exit Condition ('Infinite Loop')", "title": "CWE-835" }, { "category": "description", "text": "An integer overflow vulnerability in the DPI certificate scanner of Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103410 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103410.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103410" }, { "cve": "CVE-2026-103411", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "notes": [ { "category": "other", "text": "Integer Underflow (Wrap or Wraparound)", "title": "CWE-191" }, { "category": "description", "text": "An Integer Underflow vulnerability in Juniper Networks Session Smart Router's DhcpMessageDecoder allows a local attacker to cause information disclosure and denial of service via a malicious DHCP reply during DHCP option parsing.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103411 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103411.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-103411" }, { "cve": "CVE-2026-106079", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "A vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor's AccessManager allows attackers with config-write privileges to execute arbitrary root commands and escalate privileges via improper validation in YANG configuration updates.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2" ] }, "references": [ { "category": "self", "summary": "CVE-2026-106079 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-106079.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2" ] } ], "title": "CVE-2026-106079" } ] }