p PatchFirst

CVE-2026-103400

CVE-2026-103400 · Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ember service in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart.

CVSS 5.5 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • session smart router

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

  • session smart conductor

    Versions
    • ≥ 0, < 7.0.5: Affected (custom)
    • ≥ 7.1.0, < 7.1.7: Affected (custom)
    • ≥ 7.2.0, < 7.2.3: Affected (custom)

    Update to 7.0.5; Update to 7.1.7; Update to 7.2.3

Original sources

Check your server →