Skip to content
Fencer Vulns
critical 10.0

CVE-2024-2973 json

Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed

published 2024-06-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-27913

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running in high-availability redundant configurations are affected by this vulnerability.

No other Juniper Networks products or platforms are affected by this issue.

This issue affects:

Session Smart Router:

* All versions before 5.6.15,  * from 6.0 before 6.1.9-lts,  * from 6.2 before 6.2.5-sts.

Session Smart Conductor:

* All versions before 5.6.15,  * from 6.0 before 6.1.9-lts,  * from 6.2 before 6.2.5-sts.

WAN Assurance Router:

* 6.0 versions before 6.1.9-lts,  * 6.2 versions before 6.2.5-sts.

Patch / fix

  • Juniper Networks Session Smart Router 5.6.15, 6.1.9-lts, 6.2.5-sts
  • Juniper Networks Session Smart Conductor 5.6.15, 6.1.9-lts, 6.2.5-sts
  • Juniper Networks WAN Assurance Router 6.1.9-lts, 6.2.5-sts
  • juniper session_smart_conductor 5.6.15, 6.1.9-lts, 6.2.5-sts
  • juniper wan_assurance_router 6.1.9-lts, 6.2.5-sts
  • juniper session_smart_router 5.6.15, 6.1.9-lts, 6.2.5-sts

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.09% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA 4.0 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/V:C/RE:M/U:Red
CNA 4.0 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:M/U:Red

Affected products

  • Juniper Networks Session Smart Router
  • Juniper Networks Session Smart Conductor
  • Juniper Networks WAN Assurance Router
  • juniper session_smart_conductor
  • juniper wan_assurance_router
  • juniper session_smart_router

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.