CVE-2026-103402

Full vulnerability record from the local CVENow database.

Description

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-28 17:17:24.433000

Last modified

2026-10-28 17:17:24.850000

View original CVE JSON

{
  "id": "CVE-2026-103402",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-28T17:17:24.433",
  "lastModified": "2026-10-28T17:17:24.850",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Session Smart Router",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.1.0",
              "lessThan": "7.1.7",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.2.0",
              "lessThan": "7.2.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Juniper Networks",
          "product": "Session Smart Conductor",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.1.0",
              "lessThan": "7.1.7",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.2.0",
              "lessThan": "7.2.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA112183",
      "source": "[email protected]"
    }
  ]
}