Loading vulnerability…
DHCP Client Remote Code Execution in Juniper Session Smart Router
CVE-2026-103408 is a stack-based buffer overflow in the DHCP client of Juniper Networks Session Smart Router. Parsing attacker-controlled DHCP options in a malicious DHCP reply can allow an unauthenticated attacker on the local network to execute arbitrary code without user interaction. Affected releases include the 7.0 branch before 7.0.5, the 7.1 branch before 7.1.7, and the 7.2 branch before 7.2.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on an affected router, with potentially high impacts to confidentiality, integrity, and availability. The privileges under which attacker-controlled code executes are not specified. The vulnerability has a CVSS v3.1 score of 8.8 with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Patch, then assume compromise.
Upgrade Juniper Networks Session Smart Router to version 7.0.5 or later in the 7.0 branch, 7.1.7 or later in the 7.1 branch, or 7.2.3 or later in the 7.2 branch, following Juniper advisory JSA112183.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.