CVE-2025-11198

EUVD-2025-33403
A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.



If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.





This issue affects Security Director Policy Enforcer:  



  *  All versions before 23.1R1 Hotpatch v3.


This issue does not affect Junos Space Security Director Insights.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
juniperCNA
7.4 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
junipersecurity_director_policy_enforcer
𝑥
< 23.1
junipersecurity_director_policy_enforcer
23.1:r1
junipersecurity_director_policy_enforcer
23.1:r1_hotpatch_v1
junipersecurity_director_policy_enforcer
23.1:r1_hotpatch_v2
𝑥
= Vulnerable software versions