CVE-2025-21589: Juniper Session Smart Router Authentication Bypass
CVE-2025-21589 is an authentication bypass (CWE-288) in Juniper Session Smart Router, Session Smart Conductor and WAN Assurance Managed Routers that the record says can let a network-based attacker take administrative control of the device. The vendor scores it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2025-21589 is classified as CWE-288, an authentication bypass using an alternate path or channel. According to the record, the flaw affects Juniper Networks Session Smart Router, Session Smart Conductor and WAN Assurance Managed Routers, and a network-based attacker could bypass authentication and gain administrative control.
Impact
The record describes the impact as administrative control of the affected device after authentication is bypassed. The vendor CVSS 3.1 base score is 9.8 (critical) and the CVSS 4.0 score is 9.3. Both scores come from the CNA, sirt@juniper.net.
Affected products and versions
The record's description lists the following affected ranges for each of the three products:
- 5.6.7 before 5.6.17
- 6.0 before 6.0.8 (affected from 6.0.8)
- 6.1 before 6.1.12-lts
- 6.2 before 6.2.8-lts
- 6.3 before 6.3.3-r2
The structured affected and fixes fields in the record are empty, so these ranges come only from the description text.
Exploitation status
The record shows that the vulnerability is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The record also has no EPSS score.
Remediation and mitigation
- Identify all Session Smart Router, Session Smart Conductor and WAN Assurance Managed Routers deployments and compare their software versions with the ranges listed above.
- Plan upgrades to the releases where the listed ranges end, as indicated by the version boundaries in the description: 5.6.17, 6.0.8, 6.1.12-lts, 6.2.8-lts or 6.3.3-r2, depending on the release train in use.
- Consult the vendor advisory JSA94663 for the official remediation guidance.
- Until patching is complete, restrict access to management interfaces to trusted administrative networks and limit which sources can reach administrative services.
Detection guidance
- Review administrative login logs and device configuration changes for unexpected administrative sessions or new administrative accounts.
- Monitor management-plane traffic from untrusted networks and alert on access attempts to administrative services from unexpected sources.
- Compare device configurations against known-good baselines after any suspicious administrative activity.
Limitations of the available information
The record does not include the full text of the vendor advisory, so the exact fixed builds, any workarounds and the precise technical trigger are unknown from the sources consulted. The affected and fixes fields are empty, and no EPSS or SSVC data is available.
Frequently asked questions
What does CVE-2025-21589 allow?
According to the record, a network-based attacker could bypass authentication on affected Juniper Session Smart devices and take administrative control.
Which Juniper products are affected?
The record lists Session Smart Router, Session Smart Conductor and WAN Assurance Managed Routers, each with the version ranges given in the description.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.