{"id":"CVE-2026-103409","published":"2026-10-28T17:17:27.840","lastModified":"2026-10-28T17:17:28.083","description":"A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root.\n\nNote that this vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device is onboarded to Mist/Conductor.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://supportportal.juniper.net/JSA112183","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An unauthenticated attacker can gain administrative privileges on a Juniper Session Smart Router by sending crafted URL parameters to an insecure root-level endpoint, but only before the device is onboarded to Mist/Conductor.","exploitability":"Exploitation is straightforward for a remote attacker prior to device onboarding, requiring no authentication or user interaction.","blast_radius":"Successful exploitation grants full administrative control over the device before onboarding, enabling complete compromise of confidentiality, integrity, and availability.","remediation":"Onboard the device to Mist/Conductor immediately after deployment; no fixed version is published in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","privilege-escalation","pre-onboarding","root-access"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:42:05.518Z"}}