Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment.

Üreticinin çözüm notu (İngilizce)

The following software releases of Session Smart Router have been updated to resolve these specific issues:
* 7.0.5

and all subsequent releases;
* 7.1.7

and all subsequent releases;
* 7.2.3 and all subsequent releases.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• supportportal.juniper.net/JSA112183 Üretici bülteni

Kayıt geçmişi

1. 28 Eki 2026 19:34Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
• 7,1 CVE-2026-103411Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing
• 7,5 CVE-2026-103410Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection
• 9,8 CVE-2026-103409Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
• 8,8 CVE-2026-103408Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
• 8,8 CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management