An insecure permission assignment in RoutingManager allows a local user to access sensitive routing credentials by triggering processes that write to the /tmp directory. The vulnerability can be leveraged to read credentials that should be protected, compromising the confidentiality of routing information.

The issue affects Juniper Networks Session Smart Conductor prior to version 7.0.5, 7.1.7, and 7.2.3. Versions 7.0.5 and later, 7.1.7 and later, and 7.2.3 and later contain the fix and therefore are not vulnerable. The vulnerability is limited to environments running the affected releases of Session Smart Conductor.

The moderate CVSS score of 6.8 indicates a moderate severity and the EPSS score is not available, suggesting limited evidence of exploitation. The vulnerability is local-only, requiring the attacker to be present on the device to trigger the processes that write insecurely to /tmp. Because it does not expose a network entry point and is not included in the CISA KEV catalog, widespread remote exploitation is unlikely. Nonetheless, any local user gaining read access to the routing credentials represents a significant confidentiality risk.