CVE-2026-103407

Full vulnerability record from the local CVENow database.

Description

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-10-28 17:17:26.240000

Last modified

2026-10-28 17:17:26.397000

View original CVE JSON

{
  "id": "CVE-2026-103407",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-28T17:17:26.240",
  "lastModified": "2026-10-28T17:17:26.397",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Session Smart Router",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.1.0",
              "lessThan": "7.1.7",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.2.0",
              "lessThan": "7.2.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Juniper Networks",
          "product": "Session Smart Conductor",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0.5",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.1.0",
              "lessThan": "7.1.7",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.2.0",
              "lessThan": "7.2.3",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://supportportal.juniper.net/JSA112183",
      "source": "[email protected]"
    }
  ]
}