Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

Üreticinin çözüm notu (İngilizce)

The following software releases of Session Smart Conductor have been updated to resolve these specific issues:
* 7.0.5

and all subsequent releases;
* 7.1.7

and all subsequent releases;
* 7.2.3 and all subsequent releases.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• supportportal.juniper.net/JSA112183 Üretici bülteni

Kayıt geçmişi

1. 28 Eki 2026 19:35Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
• 8,8 CVE-2026-103407Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management
• 5,8 CVE-2026-103405Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting
• 6,8 CVE-2026-103404Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials
• 8,8 CVE-2026-103403Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules
• 8,8 CVE-2026-103402Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation