Read the docs
TI-2025-15549 Aliases CVE-2025-21589GHSA-vjjg-c428-g9r3

Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability

Priority MEDIUM 51CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device. This issue affects Session Smart Router:  * from 5.6.7 before 5.6.17,  * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts,  * from 6.2 before 6.2.8-lts,  * from 6.3 before 6.3.3-r2;  This issue affects Session Smart Conductor:  * from 5.6.7 before 5.6.17,  * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts,  * from 6.2 before 6.2.8-lts,  * from 6.3 before 6.3.3-r2;  This issue affects WAN Assurance Managed Routers:  * from 5.6.7 before 5.6.17,  * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts,  * from 6.2 before 6.2.8-lts,  * from 6.3 before 6.3.3-r2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01546 75th percentileScored 2026-11-07
Fix Fixed Session Smart Router (Juniper Networks): 5.6.17, 6.0, 6.1.12-lts +2Session Smart Conductor (Juniper Networks): 5.6.17, 6.0, 6.1.12-lts +2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperSession Smart Router5.6.7 to before 5.6.17; 6.1 to before 6.1.12-lts; 6.2 to before 6.2.8-lts; 6.3 to before 6.3.3-r25.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2Patch availableCNA
JuniperSession Smart Conductor5.6.7 to before 5.6.17; 6.1 to before 6.1.12-lts; 6.2 to before 6.2.8-lts; 6.3 to before 6.3.3-r25.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2Patch availableCNA
JuniperWAN Assurance Managed Router5.6.7 to before 5.6.17; 6.1 to before 6.1.12-lts; 6.2 to before 6.2.8-lts; 6.3 to before 6.3.3-r25.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2Patch availableCNA
  • Session Smart Router VendorJuniper Affected 5.6.7 to before 5.6.17; 6.1 to before 6.1.12-lts; 6.2 to before 6.2.8-lts; 6.3 to before 6.3.3-r2 Fixed in 5.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2 Patch available CNA
  • Session Smart Conductor VendorJuniper Affected 5.6.7 to before 5.6.17; 6.1 to before 6.1.12-lts; 6.2 to before 6.2.8-lts; 6.3 to before 6.3.3-r2 Fixed in 5.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2 Patch available CNA
  • WAN Assurance Managed Router VendorJuniper Affected 5.6.7 to before 5.6.17; 6.1 to before 6.1.12-lts; 6.2 to before 6.2.8-lts; 6.3 to before 6.3.3-r2 Fixed in 5.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2 Patch available CNA

Remediation

  • Fix · CNA Session Smart Router (Juniper Networks) Fixed in 5.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2
  • Fix · CNA Session Smart Conductor (Juniper Networks) Fixed in 5.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2
  • Fix · CNA WAN Assurance Managed Router (Juniper Networks) Fixed in 5.6.17, 6.0, 6.1.12-lts, 6.2.8-lts, 6.3.3-r2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-21589
  2. 2026-10-03 Alias added: GHSA-vjjg-c428-g9r3

References

Advisory 2

Other 1

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-20885 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults CVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
See all 1284 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences