CVE-2025-11198highCWE-306

CVE-2025-11198: falha de alta gravidade em Juniper Networks Security Director Policy…

Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server

Publicada em

Seguir esta CVE+ Monitorar Security Director Policy Enforcer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.3%
A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. This issue affects Security Director Policy Enforcer:   * All versions before 23.1R1 Hotpatch v3. This issue does not affect Junos Space Security Director Insights.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red
Produtos afetados
Juniper Networks · Security Director Policy Enforcer