CVE-2025-21589
Severity CVSS v4.0:
CRITICAL
Type:
Unavailable / Other
Publication date:
27/01/2026
Last modified:
27/01/2026
Description
An Authentication Bypass Using an<br />
Alternate Path or Channel vulnerability in Juniper Networks Session Smart<br />
Router may allows a network-based attacker to bypass authentication<br />
and take administrative control of the device.<br />
<br />
This issue affects Session Smart Router: <br />
<br />
<br />
<br />
* from 5.6.7 before 5.6.17, <br />
* from 6.0 before 6.0.8 (affected from 6.0.8),<br />
<br />
* from 6.1 before 6.1.12-lts, <br />
* from 6.2 before 6.2.8-lts, <br />
* from 6.3 before 6.3.3-r2; <br />
<br />
<br />
<br />
<br />
This issue affects Session Smart Conductor: <br />
<br />
<br />
<br />
* from 5.6.7 before 5.6.17, <br />
* from 6.0 before 6.0.8 (affected from 6.0.8),<br />
<br />
* from 6.1 before 6.1.12-lts, <br />
* from 6.2 before 6.2.8-lts, <br />
* from 6.3 before 6.3.3-r2; <br />
<br />
<br />
<br />
<br />
This issue affects WAN Assurance Managed Routers: <br />
<br />
<br />
<br />
* from 5.6.7 before 5.6.17, <br />
* from 6.0 before 6.0.8 (affected from 6.0.8),<br />
<br />
* from 6.1 before 6.1.12-lts, <br />
* from 6.2 before 6.2.8-lts, <br />
* from 6.3 before 6.3.3-r2.
Impact
Base Score 4.0
9.30
Severity 4.0
CRITICAL
Base Score 3.x
9.80
Severity 3.x
CRITICAL