CVE-2025-11198

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11198", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "state": "PUBLISHED", "assignerShortName": "juniper", "dateReserved": "2025-09-30T19:04:32.768Z", "datePublished": "2025-10-09T15:39:28.578Z", "dateUpdated": "2025-10-09T19:49:45.941Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Security Director Policy Enforcer", "vendor": "Juniper Networks", "versions": [{"lessThan": "23.1R1 Hotpatch v3", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2025-10-08T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.</div><div><p></p><div><p>If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.</p></div><p></p><p>This issue affects&nbsp;Security Director Policy Enforcer:&nbsp;&nbsp;</p></div><ul><li>All versions before 23.1R1 Hotpatch v3.</li></ul>This issue does not affect Junos Space Security Director Insights."}], "value": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.\n\n\n\nIf a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.\n\n\n\n\n\nThis issue affects\u00a0Security Director Policy Enforcer:\u00a0\u00a0\n\n\n\n * All versions before 23.1R1 Hotpatch v3.\n\n\nThis issue does not affect Junos Space Security Director Insights."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2025-10-09T15:42:07.428Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://supportportal.juniper.net/JSA103437"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The following software releases have been updated to resolve this specific issue:<br>Security Director Policy Enforcer 23.1 Hotpatch v3, 24.1R4, and all subsequent releases.<br><br>Additionally, Juniper SIRT suggests action taken to rotate secrets across all devices after upgrading.<br>"}], "value": "The following software releases have been updated to resolve this specific issue:\nSecurity Director Policy Enforcer 23.1 Hotpatch v3, 24.1R4, and all subsequent releases.\n\nAdditionally, Juniper SIRT suggests action taken to rotate secrets across all devices after upgrading."}], "source": {"advisory": "JSA103437", "defect": ["1833604"], "discovery": "USER"}, "timeline": [{"lang": "en", "time": "2026-10-08T16:00:00.000Z", "value": "Initial Publication"}], "title": "Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There are no known workarounds for this issue.<br>To reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.<br>"}], "value": "There are no known workarounds for this issue.\nTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T19:43:35.273114Z", "id": "CVE-2025-11198", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:49:45.941Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T19:43:35.273114Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:43:36.293Z"}}], "cna": {"title": "Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server", "source": {"defect": ["1833604"], "advisory": "JSA103437", "discovery": "USER"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 8.5, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/AU:Y/R:U/V:C/RE:M/U:Red", "providerUrgency": "RED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Juniper Networks", "product": "Security Director Policy Enforcer", "versions": [{"status": "affected", "version": "0", "lessThan": "23.1R1 Hotpatch v3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "supportingMedia": [{"type": "text/html", "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability.", "base64": false}]}], "timeline": [{"lang": "en", "time": "2026-10-08T16:00:00.000Z", "value": "Initial Publication"}], "solutions": [{"lang": "en", "value": "The following software releases have been updated to resolve this specific issue:\nSecurity Director Policy Enforcer 23.1 Hotpatch v3, 24.1R4, and all subsequent releases.\n\nAdditionally, Juniper SIRT suggests action taken to rotate secrets across all devices after upgrading.", "supportingMedia": [{"type": "text/html", "value": "The following software releases have been updated to resolve this specific issue:<br>Security Director Policy Enforcer 23.1 Hotpatch v3, 24.1R4, and all subsequent releases.<br><br>Additionally, Juniper SIRT suggests action taken to rotate secrets across all devices after upgrading.<br>", "base64": false}]}], "datePublic": "2025-10-08T16:00:00.000Z", "references": [{"url": "https://supportportal.juniper.net/JSA103437", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "There are no known workarounds for this issue.\nTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.", "supportingMedia": [{"type": "text/html", "value": "There are no known workarounds for this issue.<br>To reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.\n\n\n\nIf a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.\n\n\n\n\n\nThis issue affects\u00a0Security Director Policy Enforcer:\u00a0\u00a0\n\n\n\n * All versions before 23.1R1 Hotpatch v3.\n\n\nThis issue does not affect Junos Space Security Director Insights.", "supportingMedia": [{"type": "text/html", "value": "<div>A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.</div><div><p></p><div><p>If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.</p></div><p></p><p>This issue affects&nbsp;Security Director Policy Enforcer:&nbsp;&nbsp;</p></div><ul><li>All versions before 23.1R1 Hotpatch v3.</li></ul>This issue does not affect Junos Space Security Director Insights.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "shortName": "juniper", "dateUpdated": "2025-10-09T15:42:07.428Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11198", "state": "PUBLISHED", "dateUpdated": "2025-10-09T19:49:45.941Z", "dateReserved": "2025-09-30T19:04:32.768Z", "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968", "datePublished": "2025-10-09T15:39:28.578Z", "assignerShortName": "juniper"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Security Director Policy Enforcer", "vendor": "Juniper Networks", "versions": [{"lessThan": "23.1R1 Hotpatch v3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "sirt@juniper.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:juniper:security_director_policy_enforcer:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6CF83B9-9580-4B3F-A076-55490B29B649", "versionEndExcluding": "23.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_director_policy_enforcer:23.1:r1:*:*:*:*:*:*", "matchCriteriaId": "C1596EA6-222E-4966-8D1D-1A23D6E665F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_director_policy_enforcer:23.1:r1_hotpatch_v1:*:*:*:*:*:*", "matchCriteriaId": "8B57EF97-956E-4686-AECD-906A0FA8F7FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:juniper:security_director_policy_enforcer:23.1:r1_hotpatch_v2:*:*:*:*:*:*", "matchCriteriaId": "B2254C73-603C-4096-BD7D-736A893E0492", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.\n\n\n\nIf a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.\n\n\n\n\n\nThis issue affects\u00a0Security Director Policy Enforcer:\u00a0\u00a0\n\n\n\n * All versions before 23.1R1 Hotpatch v3.\n\n\nThis issue does not affect Junos Space Security Director Insights."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n faltante para funci\u00f3n cr\u00edtica en Juniper Networks Security Director Policy Enforcer permite a un atacante no autenticado y basado en la red reemplazar im\u00e1genes vSRX leg\u00edtimas por otras maliciosas.\n\nSi un usuario de confianza inicia la implementaci\u00f3n, Security Director Policy Enforcer entregar\u00e1 la imagen cargada por el atacante a VMware NSX en lugar de una leg\u00edtima.\n\nEste problema afecta a Security Director Policy Enforcer:\n\n* Todas las versiones anteriores a 23.1R1 Hotpatch v3.\n\nEste problema no afecta a Junos Space Security Director Insights."}], "id": "CVE-2025-11198", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "sirt@juniper.net", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "sirt@juniper.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11198", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-09T19:43:35.273114Z", "version": "2.0.3"}}]}, "published": "2025-10-09T16:15:44.270", "references": [{"source": "sirt@juniper.net", "tags": ["Vendor Advisory"], "url": "https://supportportal.juniper.net/JSA103437"}], "sourceIdentifier": "sirt@juniper.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "sirt@juniper.net", "type": "Secondary"}]}

{}

{"created": "2025-10-10T11:17:46.201011+00:00", "updated": "2025-10-10T11:17:46.201059+00:00", "vendors": ["juniper", "juniper$PRODUCT$junos", "juniper$PRODUCT$space_security_director"]}