The vulnerability arises from an out-of-bounds write in the SSR TCP proxy/optimization path. An attacker controlling the TCP option length in a transit TCP packet can corrupt forwarded packet data, leading to a potential data‑plane crash. This flaw is an example of CWE‑787, where improper bounds checking causes memory corruption.

Juniper Networks Session Smart Router is affected. All releases prior to the following updates contain the flaw: 7.0.5 and later fixes the issue for the 7.0 series; 7.1.7 fixes it for the 7.1 series; 7.2.3 fixes it for the 7.2 series. Therefore, any deployed version older than those is vulnerable.

The CVSS score of 5.3 suggests a medium severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to inject a crafted transit TCP packet that traverses the router’s TCP proxy. While exploitability is not trivial, an adversary with network access could send the packet and potentially cause a data‑plane crash, impacting availability.