- Juniper Networks says it discovered a important flaw throughout inside testing
- Session Sensible routers bug has a 9.8 severity rating and permits full gadget takeover
- A patch is already accessible, so replace now
Juniper Networks simply launched a patch for a important vulnerability that allowed menace actors to take over Session Sensible Routers (SSR).
In a safety advisory, the corporate stated that in inside testing, it found CVE-2025-21589, an authentication bypass vulnerability with a severity rating of 9.8/10 (important). This situation impacts Session Sensible Router, Session Sensible Conductor, and WAN Assurance Managed Router – the affected endpoints embody:
Session Sensible Router:
from 5.6.7 earlier than 5.6.17,
from 6.0.8,
from 6.1 earlier than 6.1.12-lts,
from 6.2 earlier than 6.2.8-lts,
from 6.3 earlier than 6.3.3-r2;
Session Sensible Conductor:
from 5.6.7 earlier than 5.6.17,
from 6.0.8,
from 6.1 earlier than 6.1.12-lts,
from 6.2 earlier than 6.2.8-lts,
from 6.3 earlier than 6.3.3-r2;
WAN Assurance Managed Routers:
from 5.6.7 earlier than 5.6.17,
from 6.0.8,
from 6.1 earlier than 6.1.12-lts,
from 6.2 earlier than 6.2.8-lts,
from 6.3 earlier than 6.3.3-r2.
No workarounds
Juniper stated that there aren’t any workarounds for this situation, and that the one option to safeguard the endpoints is to use the patches: SSR-5.6.17, SSR-6.1.12-lts, SSR-6.2.8-lts, SSR-6.3.3-r2 and subsequent releases.
“In a Conductor-managed deployment, it’s adequate to improve solely the Conductor nodes and the repair might be utilized mechanically to all linked routers,” Juniper defined. “As sensible, the routers ought to nonetheless be upgraded to a set model nonetheless they won’t be susceptible as soon as they connect with an upgraded Conductor. Router patching could be confirmed as soon as the router reaches the “operating” (on 6.2 and earlier) or “synchronized” (on 6.3+) state on the Conductor”.
Units that function with WAN Assurance, linked to the Mist Cloud, are mechanically up to date. The routers ought to nonetheless be upgraded, it was stated.
Thus far, there isn’t a proof of the issues being abused within the wild.
By way of BleepingComputer