CVE-2025-21589: fallo crítico en Juniper Networks Session Smart Router
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 1.5%
An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.
This issue affects Session Smart Router:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
* from 5.6.7 before 5.6.17,
* from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts,
* from 6.2 before 6.2.8-lts,
* from 6.3 before 6.3.3-r2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Juniper Networks · Session Smart ConductorJuniper Networks · Session Smart RouterJuniper Networks · WAN Assurance Managed RouterCVEs relacionadas — Juniper Networks Session Smart Router
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-106079HIGHSession Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configurationEPSS 1.2%CVE-2026-103403HIGHSession Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rulesEPSS 1.2%CVE-2024-2973CRITICALSession Smart Router(SSR): On redundant router deployments API authentication can be bypassedEPSS 1.1%CVE-2026-103406CRITICALSession Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.EPSS 0.5%CVE-2026-103390MEDIUMSession Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identificationEPSS 0.4%CVE-2026-103409CRITICALSession Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessedEPSS 0.3%