CVE-2025-59968

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-59968
A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.  Tampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls. This issue affects Junos Space Security Director * all versions prior to 24.1R3 Patch V4 This issue does not affect managed cSRX Series devices.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://supportportal.juniper.net/JSA103157 Vendor Advisory
https://www.juniper.net/documentation/us/en/software/nm-apps24.1/junos-space-security-director/topics/task/junos-space-metadata-creating.html Technical Description
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:juniper:space_security_director:*:*:*:*:*:*:*:*
cpe:2.3:a:juniper:space_security_director:24.1:r1:*:*:*:*:*:*
cpe:2.3:a:juniper:space_security_director:24.1:r2:*:*:*:*:*:*
cpe:2.3:a:juniper:space_security_director:24.1:r3:*:*:*:*:*:*
OR cpe:2.3:a:juniper:vsrx:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx1600:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx2300:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4120:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4300:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx4700:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*
cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*
History

18 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de autorización faltante en Juniper Networks Junos Space Security Director permite a un atacante no autenticado basado en red leer o modificar metadatos a través de la interfaz web. La manipulación de estos metadatos puede resultar en que los dispositivos gestionados de la serie SRX permitan tráfico de red que de otro modo debería ser bloqueado por política, eludiendo eficazmente los controles de seguridad previstos. Este problema afecta a Junos Space Security Director * todas las versiones anteriores a 24.1R3 Parche V4 Este problema no afecta a los dispositivos gestionados de la serie cSRX.
Information

Published : 2025-10-09 16:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-59968

Mitre link : CVE-2025-59968

CVE.ORG link : CVE-2025-59968

JSON object : View

Products Affected

juniper

  • srx4120
  • vsrx
  • space_security_director
  • srx5400
  • srx5800
  • srx300
  • srx4300
  • srx340
  • srx4600
  • srx4700
  • srx1600
  • srx345
  • srx5600
  • srx320
  • srx1500
  • srx4100
  • srx4200
  • srx380
  • srx2300
CWE
CWE-862

Missing Authorization