A flaw in the link resolution logic before file access allows a local unprivileged user to write any file with root privileges on Juniper Networks Session Smart Router and Session Smart Conductor devices. This can be used to modify configuration files, replace binaries, or install malicious code, effectively compromising the entire device. The vulnerability is categorized as an improper link resolution issue (CWE‑59) and provides a direct path for elevation of privileges and persistence.

The affected products are Juniper Networks Session Smart Router and Session Smart Conductor. Routers that are not yet onboarded to a Conductor or are Mist‑managed remain vulnerable because they expose unauthenticated API endpoints. Devices already managed by a Conductor are not affected. Updating the firmware to any release 7.0.5 or later, 7.1.7 or later, or 7.2.3 or later removes the flaw.

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS is not available, so the likely exploitation probability is unclear; the lack of a KEV listing also suggests no widespread exploitation reports yet. The attack vector is inferred to be local or internal network access to the web server API, as the flaw accepts unauthenticated requests. An attacker with even limited local access can overwrite critical system files as root, providing full control over the device.