{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ajuniper_networkssession_smart_router/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:juniper:session_smart_router:*:*:*:*:*:*:*:*","cpe:2.3:a:juniper:session_smart_conductor:*:*:*:*:*:*:*:*","cpe:2.3:a:juniper_networks:session_smart_router:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-103409"},{"cvss":8.8,"id":"CVE-2026-103401"},{"cvss":8.8,"id":"CVE-2026-103402"},{"cvss":8.8,"id":"CVE-2026-103403"},{"cvss":8.8,"id":"CVE-2026-103408"},{"cvss":7.1,"id":"CVE-2026-103411"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-103409\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Session Smart Router","Session Smart Conductor"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","network-security","authentication-bypass","privilege-escalation","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["Juniper Networks"],"content_html":"\u003cp\u003eCVE-2026-103409 is a missing authentication for critical function vulnerability affecting Juniper Networks Session Smart Router. An unauthenticated attacker can exploit this via crafted URL parameters sent to a root-level endpoint. This flaw is only exploitable on devices that have not yet been onboarded to Mist or Conductor management systems. Once a device is successfully onboarded, the vulnerability is no longer exploitable.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn unauthenticated network-based attacker can achieve administrative privileges on affected appliances, potentially leading to full device compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the onboarding of all new Session Smart Router appliances to Mist or Conductor immediately upon deployment. This action renders the vulnerability non-exploitable. Monitor network traffic directed at unmanaged or staging routers for unauthorized access attempts to administrative endpoints.\u003c/p\u003e\n","date_modified":"2026-10-28T19:23:52Z","date_published":"2026-10-28T18:36:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-juniper-ssr-auth-bypass/","summary":"A missing authentication vulnerability in Juniper Networks Session Smart Router allows unauthenticated network-based attackers to escalate privileges via crafted URL parameters on non-onboarded devices.","title":"Juniper Networks Session Smart Router: Missing authentication for critical function (CVE-2026-103409)","url":"https://feed.craftedsignal.io/briefs/2026-10-juniper-ssr-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:juniper_networks:session_smart_router:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}