A stack buffer overflow in the Session Smart Router DHCP client can be triggered by parsing malicious DHCP options. The flaw allows an unauthenticated attacker on the local network to execute arbitrary code on the device. This could lead to full control of the router, enabling further lateral movement, data exfiltration, or disruption of network services. The underlying weakness is reflected in CWE‑121, which denotes stack-based buffer overflows that overwrite return addresses or control data.

Juniper Networks Session Smart Router appliances running firmware versions prior to 7.0.5, 7.1.7, or 7.2.3 are vulnerable. All releases following those specific versions contain the fix and are no longer impacted.

The vulnerability scores a CVSS of 8.8, indicating high severity. While the EPSS score is not available, the flaw can be exploited locally by an attacker who can send crafted DHCP responses, with no need for user interaction or privileged access. The issue is not listed in the CISA KEV catalog, but its local nature and high impact make it a serious risk for environments where unauthenticated devices can send DHCP traffic to the router.