Juniper Networks has issued an urgent security advisory addressing a critical API authentication bypass vulnerability (CVE-2025-21589) affecting its Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router product lines. Security teams must prioritize inventory audits using tools like Juniper HealthBot and implement Zero Trust Network Access (ZTNA) controls for management interfaces as interim measures while awaiting patch deployment. Juniper’s Security Incident Response Team (SIRT) confirms the vulnerability was discovered during internal fuzz testing of the gRPC-based management protocol, with no observed in-the-wild exploitation as of February 18, 2025. While patch application causes sub-30-second API management plane disruptions, data forwarding operations remain unaffected thanks to the separation of control and data planes in Juniper’s Session Smart architecture. Affected configurations include Session Smart Router versions from 5.6.7 before 5.6.17, 6.0.8 through 6.1.12-lts, 6.2.8-lts, and 6.3.3-r2; Session Smart Conductor installations with equivalent version ranges; and WAN Assurance Managed Routers matching these parameters. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This cryptographic failure enables unauthorized access to the /api/v1/config endpoint, where attackers can deploy malicious routing policies or exfiltrate session keys through GET requests to /api/v1/system/security/keys. As enterprises accelerate SDN adoption, this incident reinforces the necessity of continuous API security validation through DAST (Dynamic Application Security Testing) and runtime protection mechanisms.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 18 Feb 2025 10:35:14 +0000