Pierluigi Paganini February 18, 2025

Juniper Networks has addressed a critical vulnerability, tracked as CVE-2025-21589, impacting the Session Smart Router.

Juniper Networks addressed a critical authentication bypass vulnerability, tracked as CVE-2025-21589 (CVSS score of 9.8), affecting its Session Smart Router product.

“An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allow a network-based attacker to bypass authentication and take administrative control of the device.” reads the advisory.

The vulnerability impacts Session Smart Router: 

• from 5.6.7 before 5.6.17, 
• from 6.0.8,
• from 6.1 before 6.1.12-lts, 
• from 6.2 before 6.2.8-lts, 
• from 6.3 before 6.3.3-r2; 

and Session Smart Conductor: 

• from 5.6.7 before 5.6.17, 
• from 6.0.8,
• from 6.1 before 6.1.12-lts, 
• from 6.2 before 6.2.8-lts, 
• from 6.3 before 6.3.3-r2; 

and WAN Assurance Managed Routers: 

• from 5.6.7 before 5.6.17, 
• from 6.0.8,
• from 6.1 before 6.1.12-lts, 
• from 6.2 before 6.2.8-lts, 
• from 6.3 before 6.3.3-r2.

The vendor addressed the flaw with SSR-5.6.17, SSR-6.1.12-lts, SSR-6.2.8-lts, SSR-6.3.3-r2 and subsequent releases.

Devices using WAN Assurance with Mist Cloud have received an automatic patch, but upgrading to a fixed version is still recommended.

The company states that there are no known workarounds for this flaw. The company SIRT is not aware of attacks in the wild exploiting this vulnerability.

In July 2024, Juniper Networks released out-of-band security updates to address a critical vulnerability, tracked as CVE-2024-2973 (CVSS score of 10.0), that could lead to an authentication bypass in some of its routers. The company discovered the vulnerability during internal product security testing or research.

The flaw in Juniper Networks Session Smart Router or Conductor with a redundant peer allows a network-based attacker to bypass authentication and gain full control of the device. The vulnerability only impacts routers or conductors that are running in high-availability redundant configurations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Session Smart Router)