CVE-2026-103409

Summary

An unauthenticated attacker can gain administrative privileges on a Juniper Session Smart Router by sending crafted URL parameters to an insecure root-level endpoint, but only before the device is onboarded to Mist/Conductor.

Exploitability

Exploitation is straightforward for a remote attacker prior to device onboarding, requiring no authentication or user interaction.

Blast radius

Successful exploitation grants full administrative control over the device before onboarding, enabling complete compromise of confidentiality, integrity, and availability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Onboard the device to Mist/Conductor immediately after deployment; no fixed version is published in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.