Juniper fixes 18 Session Smart flaws, including root command execution
The Netherlands’ NCSC reported on October 30 that Juniper had fixed 18 vulnerabilities across Session Smart Router and Session Smart Conductor, including critical flaws. The issues affect different components and range from unauthenticated network access to local-only vulnerabilities.
One critical Conductor flaw is in AutomatedProvisioner: a specially crafted Salt minion ID can trigger remote command execution as root without authentication. Other flaws include an authentication bypass. A Conductor compromise could therefore expose the management system itself, not just an individual forwarding router.
If Conductor manages routers in your network, its compromise could affect managed network operations; the advisory does not establish active exploitation or how far an intrusion could spread.
2 sources · 6h ago
CVEs in this update
18 CVEs
Across Session Smart Conductor, Session Smart Router.
Aggiornamenti di sicurezza per prodotti Juniper Networks
Juniper Networks ha rilasciato aggiornamenti di sicurezza che sanano 18 vulnerabilità, di cui 2 con gravità "critica" e 8 con gravità "alta", nei prodotti Session Smart Router e Session Smart Conductor, soluzioni dedicate rispettivamente al routing e alla relativa gestione.