CVE-2025-21589
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jan 27, 2026
- Updated
- Jan 27, 2026
- Reserved
- Dec 26, 2024
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.
This issue affects Session Smart Router:
* from 5.6.7 before 5.6.17, * from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts, * from 6.2 before 6.2.8-lts, * from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
* from 5.6.7 before 5.6.17, * from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts, * from 6.2 before 6.2.8-lts, * from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
* from 5.6.7 before 5.6.17, * from 6.0 before 6.0.8 (affected from 6.0.8),
* from 6.1 before 6.1.12-lts, * from 6.2 before 6.2.8-lts, * from 6.3 before 6.3.3-r2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | juniper |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | juniper |
Weaknesses
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected Products
| Product | Versions |
|---|---|
Session Smart RouterJuniper Networks |
|
Session Smart ConductorJuniper Networks |
|
WAN Assurance Managed RouterJuniper Networks |
|
References
- https://supportportal.juniper.net/vendor-advisory
- https://support.juniper.net/support/eol/software/ssr/related
- https://kb.juniper.net/JSA94663vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.