CVE-2021-31349

9.8 criticalEPSS 1.7%

Critical (9.8) in juniper 128 technology session smart router firmware. EPSS 1.7% chance of exploitation in the next 30 days.

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2021-10-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

juniper:128_technology_session_smart_router_firmware

References

https://kb.juniper.net/JSA11256
https://kb.juniper.net/JSA11256

Check your stack JSON