CVE-2026-103405mediumCWE-74

CVE-2026-103405: fallo de gravedad media en Juniper Networks Session Smart Router

Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

Publicada el

Seguir esta CVE+ Monitorear Session Smart Router+ Monitorear Session Smart Conductor

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.8epss 0.2%
An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Productos afectados
Juniper Networks · Session Smart ConductorJuniper Networks · Session Smart Router
CVEs relacionadas — Juniper Networks Session Smart Router

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-21589CRITICALSession Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerabilityEPSS 1.5%CVE-2026-106079HIGHSession Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configurationEPSS 1.2%CVE-2026-103403HIGHSession Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rulesEPSS 1.2%CVE-2024-2973CRITICALSession Smart Router(SSR): On redundant router deployments API authentication can be bypassedEPSS 1.1%CVE-2026-103406CRITICALSession Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.EPSS 0.5%CVE-2026-103390MEDIUMSession Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identificationEPSS 0.4%