Summary: Juniper Networks has issued a security bulletin for a critical authentication bypass vulnerability (CVE-2025-21589) affecting its Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router products, with a CVSS score of 9.8. This vulnerability allows attackers to bypass authentication and gain administrative control over affected devices. All users are strongly urged to upgrade to the latest patched versions to avoid exploitation, as there are currently no known workarounds.
Affected: Juniper Networks Session Smart Router, Session Smart Conductor, WAN Assurance Managed Router
Keypoints :
- Vulnerability CVE-2025-21589 allows bypassing of authentication for certain Juniper products.
- Recommended upgrades include versions SSR-5.6.17, SSR-6.1.12-lts, SSR-6.2.8-lts, and SSR-6.3.3-r2.
- WAN Assurance users connected to Mist Cloud have received automatic patches; manual upgrades are still encouraged.
- No known exploitations have been identified, but urgent mitigation is needed due to the vulnerability’s severity.