8.8Alta
CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management
Descripción
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API.
Debilidad (CWE):
CWE-22
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Juniper Networks | Session Smart Conductor | < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 | |
| Juniper Networks | Session Smart Router | < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 |
Referencias y parches
- https://supportportal.juniper.net/JSA112183 vendor-advisory