Skip to content
OpenAdvisories
High · 8.8 CVE-2026-106079 EUVD-2026-112167GHSA-m4j2-cq9m-w4h4

Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

Published Oct 28, 2026 · Updated Nov 5, 2026 · Assigned by juniper

Vendor: Juniper Networks Product: Session Smart Conductor Product: Session Smart Router Category: Network devices

Description

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration.

Affected products

VendorProductAffectedFixed
Juniper Networks Session Smart Router < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 7.0.5
Juniper Networks Session Smart Conductor < 7.0.5, 7.1.0 – < 7.1.7, 7.2.0 – < 7.2.3 7.0.5

Advisories 2

References