CVE-2026-103408 - Vulnerability Details - OpenCVE

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Juniper	Session Smart Router

No data.

No data.

References

Link	Providers
https://supportportal.juniper.net/JSA112183

History

Sat, 07 Nov 2026 07:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 28 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Juniper Juniper session Smart Router
Vendors & Products		Juniper Juniper session Smart Router

Wed, 28 Oct 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.
Title		Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
Weaknesses		CWE-121
References		https://supportportal.juniper.net/JSA112183
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: juniper

Published: 2026-10-28T16:36:33.095Z

Updated: 2026-11-06T18:30:04.638Z

Reserved: 2026-09-30T14:33:03.168Z

Link: CVE-2026-103408

Vulnrichment

Updated: 2026-11-06T18:29:58.480Z

NVD

Status : Awaiting Analysis

Published: 2026-10-28T17:17:26.520

Modified: 2026-11-06T19:17:05.873

Link: CVE-2026-103408

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103408", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2026-09-30T14:33:03.168Z", "datePublished": "2026-10-28T16:36:33.095Z", "dateUpdated": "2026-11-06T18:30:04.638Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Session Smart Router", "vendor": "Juniper Networks", "versions": [{"lessThan": "7.0.5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.1.7", "status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThan": "7.2.3", "status": "affected", "version": "7.2.0", "versionType": "custom"}]}], "datePublic": "2026-10-28T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply."}], "value": "A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2026-10-28T16:36:33.095Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://supportportal.juniper.net/JSA112183"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The following software releases of Session Smart Router have been updated to resolve these specific issues:<br><ul><li>7.0.5 \n\nand all subsequent releases;</li><li>7.1.7 \n\nand all subsequent releases;</li><li>7.2.3 and all subsequent releases.</li></ul>\n\n<br>"}], "value": "The following software releases of Session Smart Router have been updated to resolve these specific issues:\n * 7.0.5 \n\nand all subsequent releases;\n * 7.1.7 \n\nand all subsequent releases;\n * 7.2.3 and all subsequent releases."}], "source": {"advisory": "JSA112183", "defect": ["I95-65211"], "discovery": "INTERNAL"}, "title": "Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There are no known workarounds for this issue."}], "value": "There are no known workarounds for this issue."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T18:25:30.490631Z", "id": "CVE-2026-103408", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:30:04.638Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-103408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-06T18:25:30.490631Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T18:29:58.480Z"}}], "cna": {"title": "Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options", "source": {"defect": ["I95-65211"], "advisory": "JSA112183", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Juniper Networks", "product": "Session Smart Router", "versions": [{"status": "affected", "version": "0", "lessThan": "7.0.5", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.7", "versionType": "custom"}, {"status": "affected", "version": "7.2.0", "lessThan": "7.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "base64": false}]}], "solutions": [{"lang": "en", "value": "The following software releases of Session Smart Router have been updated to resolve these specific issues:\n * 7.0.5 \n\nand all subsequent releases;\n * 7.1.7 \n\nand all subsequent releases;\n * 7.2.3 and all subsequent releases.", "supportingMedia": [{"type": "text/html", "value": "The following software releases of Session Smart Router have been updated to resolve these specific issues:<br><ul><li>7.0.5 \n\nand all subsequent releases;</li><li>7.1.7 \n\nand all subsequent releases;</li><li>7.2.3 and all subsequent releases.</li></ul>\n\n<br>", "base64": false}]}], "datePublic": "2026-10-28T16:00:00.000Z", "references": [{"url": "https://supportportal.juniper.net/JSA112183", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue.", "supportingMedia": [{"type": "text/html", "value": "There are no known workarounds for this issue.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.", "supportingMedia": [{"type": "text/html", "value": "A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2026-10-28T16:36:33.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103408", "state": "PUBLISHED", "dateUpdated": "2026-11-06T18:30:04.638Z", "dateReserved": "2026-09-30T14:33:03.168Z", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "datePublished": "2026-10-28T16:36:33.095Z", "assignerShortName": "juniper"}, "dataVersion": "5.2"}