Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.0.5, 7.1.7, 7.2.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Juniper Networks Session Smart Router and Session Smart Conductor are affected by a flaw that lets a local, unprivileged user overwrite arbitrary files with root privileges by abusing unauthenticated web API endpoints. This could allow full compromise of the device, though routers already managed by a Conductor are not affected.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Juniper Networks Session Smart Router
fixed in 7.0.5; From 7.1.0 · fixed in 7.1.7; From 7.2.0 · fixed in 7.2.3
- Juniper Networks Session Smart Conductor
fixed in 7.0.5; From 7.1.0 · fixed in 7.1.7; From 7.2.0 · fixed in 7.2.3