The reported defect is an Improper Initialization flaw that allows the software to use incorrect encryption keys during security policy updates. An attacker can decrypt traffic that should remain protected, or cause denial of service by triggering failures when policies are applied. This weakness is a key management error that directly undermines confidentiality and availability for all traffic processed by the Session Smart Router.

The vulnerability affects Juniper Networks Session Smart Router products. Versions 7.0.5 and newer, 7.1.7 and newer, and 7.2.3 and newer are all impacted, as these releases incorporate the affected code path. The patch set described by Juniper covers all releases above those minimum versions.

The CVSS score of 3.7 classifies this vulnerability as low severity, yet it is still exploitable. The lack of an EPSS score means no exploitation probability is available from that source, and the issue is not listed in CISA’s KEV catalog. The most likely attack path involves a malicious or compromised administrator who is able to initiate or modify a security policy; the attack requires legitimate access to policy configuration interfaces. No workaround is available, so the only mitigations are to apply the vendor‑supplied patch or to restrict policy‑update capabilities.