Advisory · CVE-2026-103408
Remote code execution via malicious DHCP reply on Juniper Session Smart Router
An unauthenticated attacker on the local network can achieve remote code execution on Juniper Session Smart Router with a malicious DHCP reply. Juniper rates it 8.8.
- Vendor
- Juniper Networks
- Product
- Session Smart Router
- Identifier / CWE
- CVE-2026-103408
CWE-121 - Action timing
- Immediate
Explain it like I’m five
The router trusts whatever the local network hands it during address setup. A rigged reply overflows a buffer and takes over the DHCP client.
- 01Local network position
An unauthenticated attacker is on the local network segment.
- 02Malicious DHCP reply
The attacker sends a crafted DHCP reply to the router.
- 03Buffer overflow
The stack buffer overflow in the DHCP client yields remote code execution.
What happened
Juniper disclosed Session Smart releases before 7.0.5, 7.1.0 through 7.1.6, and 7.2.0 through 7.2.2 as affected for Session Smart Router. A Stack Buffer Overflow vulnerability in the DHCP client allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply. Juniper rates it 8.8.
Exploitation needs adjacent network access rather than internet reachability, which limits opportunistic scanning but not a compromised device or rogue actor already inside the local segment.
What to do
- Inventory Session Smart Routers, especially on shared or untrusted segments.
- Upgrade to 7.0.5, 7.1.7, or 7.2.3 or later on the matching release line.
- Segment DHCP services and monitor for rogue DHCP servers.
- Review logs for abnormal DHCP traffic or unexpected client crashes.
- Confirm the deployed version after patching.
Management note
DHCP is trusted infrastructure, which is why a DHCP client overflow matters: any foothold on the local segment becomes a router compromise. Segment accordingly.