VYPR
← All advisories
High severity7.4NVD Advisory· Published Oct 9, 2025· Updated Jun 17, 2026

CVE-2025-11198

CVE-2025-11198

Description

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.

If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.

This issue affects Security Director Policy Enforcer:

  • All versions before 23.1R1 Hotpatch v3.

This issue does not affect Junos Space Security Director Insights.

Affected products

6
  • Juniper Networks/Security Director Policy Enforcerllm-fuzzy6 versions
    <23.1R1 Hotpatch v3+ 5 more
    • (no CPE)range: <23.1R1 Hotpatch v3
    • (no CPE)range: 0
    • cpe:2.3:a:juniper:security_director_policy_enforcer:*:*:*:*:*:*:*:*range: <23.1
    • cpe:2.3:a:juniper:security_director_policy_enforcer:23.1:r1:*:*:*:*:*:*
    • cpe:2.3:a:juniper:security_director_policy_enforcer:23.1:r1_hotpatch_v1:*:*:*:*:*:*
    • cpe:2.3:a:juniper:security_director_policy_enforcer:23.1:r1_hotpatch_v2:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.