Juniper SSR < 7.0.5 / 7.1.x < 7.1.7 / 7.2.x < 7.2.3 Multiple Vulnerabilities (JSA112183)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(374264);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/30");

  script_cve_id(
    "CVE-2026-103390",
    "CVE-2026-103391",
    "CVE-2026-103392",
    "CVE-2026-103393",
    "CVE-2026-103394",
    "CVE-2026-103400",
    "CVE-2026-103401",
    "CVE-2026-103402",
    "CVE-2026-103403",
    "CVE-2026-103404",
    "CVE-2026-103405",
    "CVE-2026-103406",
    "CVE-2026-103407",
    "CVE-2026-103408",
    "CVE-2026-103409",
    "CVE-2026-103410",
    "CVE-2026-103411",
    "CVE-2026-106079"
  );
  script_xref(name:"IAVA", value:"2026-A-1225");
  script_xref(name:"JSA", value:"JSA112183");

  script_name(english:"Juniper SSR < 7.0.5 / 7.1.x < 7.1.7 / 7.2.x < 7.2.3 Multiple Vulnerabilities (JSA112183)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Juniper Session Smart Router (SSR) or Session Smart Conductor installed on the remote host is
prior to 7.0.5, 7.1.x prior to 7.1.7, or 7.2.x prior to 7.2.3. It is, therefore, affected by multiple
vulnerabilities as referenced in the JSA112183 advisory.

  - An Improper Neutralization of Special Elements used in an OS Command vulnerability in the
    AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute
    arbitrary commands as root via a specially crafted salt minion ID. (CVE-2026-103406)

  - A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router
    allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted
    URL parameters to an insecure endpoint running as root. Note that this vulnerability can only be exploited
    prior to the device being onboarded to Mist/Conductor. The issue can no longer be exploited once a device
    is onboarded to Mist/Conductor. (CVE-2026-103409)

  - An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web
    server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local
    unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This
    vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been
    onboarded to a Conductor. Routers already managed by Conductor are not affected. (CVE-2026-103401)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://supportportal.juniper.net/JSA112183");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Juniper Session Smart Router or Session Smart Conductor version 7.0.5, 7.1.7, 7.2.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-103406");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:juniper:128_technology_session_smart_router");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("juniper_session_smart_router_version.nbin");
  script_require_keys("installed_sw/Juniper Session Smart Router");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "checks": [
    {
      "product": {
        "name": "Juniper Session Smart Router",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "7.0.5"
        },
        {
          "min_version": "7.1.0",
          "fixed_version": "7.1.7"
        },
        {
          "min_version": "7.2.0",
          "fixed_version": "7.2.3"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);