What’s Vulnerable › Vulnerabilities

CVE-2021-31349: Session Smart Router: Authentication Bypass Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-19 · updated 2026-06-17
• Weakness: CWE-287

Description

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

Affected products

• Juniper Networks 128 Technology Session Smart Router: before 4.5.11; from 5.0.0 through 5.0.1 — fixed in 4.5.11

How to fix

Upgrade to a fixed version: Juniper Networks 128 Technology Session Smart Router 4.5.11. Check the vendor advisory for mitigations.

References

• https://kb.juniper.net/JSA11256
• https://kb.juniper.net/JSA11256

Get alerted when CVE-2021-31349 or the next vulnerability affects your stack