CVE-2026-103390mediumCWE-125

CVE-2026-103390: fallo de gravedad media en Juniper Networks Session Smart Router

Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Session Smart Router+ Monitorear Session Smart Conductor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
Juniper Networks · Session Smart ConductorJuniper Networks · Session Smart Router
CVEs relacionadas — Juniper Networks Session Smart Router

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-21589CRITICALSession Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerabilityEPSS 1.5%CVE-2026-106079HIGHSession Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configurationEPSS 1.2%CVE-2026-103403HIGHSession Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rulesEPSS 1.2%CVE-2024-2973CRITICALSession Smart Router(SSR): On redundant router deployments API authentication can be bypassedEPSS 1.1%CVE-2026-103406CRITICALSession Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.EPSS 0.5%CVE-2026-103409CRITICALSession Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessedEPSS 0.3%