CVE-2025-59968 (GCVE-0-2025-59968)

Vulnerability from cvelistv5 – Published: 2025-10-09 15:48 – Updated: 2025-10-09 16:03
VLAI
Title
Junos Space Security Director: Insufficient authorization for sensitive resources in web interface
Summary
A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.  Tampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls. This issue affects Junos Space Security Director * all versions prior to 24.1R3 Patch V4 This issue does not affect managed cSRX Series devices.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/AU:Y/R:A/V:C/RE:M/U:Green
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-09 16:03 UTC
CWE
  • CWE‑862: Missing Authorization
Assigner
juniper CNA under the mitre root
CNA scorecard B 84/100 over 193 records in the last 180 days details
References
Impacted products
Date Public
2025-10-08 16:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-09T16:03:14.737515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-09T16:03:31.610Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junos Space Security Director",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "24.1R3 Patch V4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "cSRX"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "platforms": [
            "vSRX Series",
            "SRX Series"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRequired Configuration for Exposure:\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\u003c/span\u003eCreate a Metadata using the Create Metadata administrative page."
            }
          ],
          "value": "Required Configuration for Exposure:\u00a0\nCreate a Metadata using the Create Metadata administrative page."
        }
      ],
      "datePublic": "2025-10-08T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eA Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eTampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eThis issue affects Junos Space Security Director \u003cbr\u003e\u003cul\u003e\u003cli\u003e all versions prior to 24.1R3 Patch V4\u003c/li\u003e\u003c/ul\u003eThis issue does not affect managed cSRX Series devices.\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.\u00a0\n\n\n\n\nTampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls.\n\n\n\nThis issue affects Junos Space Security Director \n  *   all versions prior to 24.1R3 Patch V4\n\n\nThis issue does not affect managed cSRX Series devices."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "GREEN",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/AU:Y/R:A/V:C/RE:M/U:Green",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE\u2011862: Missing Authorization",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-09T15:48:08.091Z",
        "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "shortName": "juniper"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportportal.juniper.net/JSA103157"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://www.juniper.net/documentation/us/en/software/nm-apps24.1/junos-space-security-director/topics/task/junos-space-metadata-creating.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe following software releases have been updated to resolve this specific issue:\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eJunos Space Security Director: 24.1R3 Patch V4, 24.1R4\u0026nbsp;and all subsequent releases.\u003c/div\u003e"
            }
          ],
          "value": "The following software releases have been updated to resolve this specific issue:\u00a0\n\n\n\n\nJunos Space Security Director: 24.1R3 Patch V4, 24.1R4\u00a0and all subsequent releases."
        }
      ],
      "source": {
        "advisory": "JSA103157",
        "defect": [
          "1867545"
        ],
        "discovery": "USER"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-08T16:00:00.000Z",
          "value": "Initial Publication"
        }
      ],
      "title": "Junos Space Security Director: Insufficient authorization for sensitive resources in web interface",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no known workarounds for this issue.\u003cbr\u003eTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "There are no known workarounds for this issue.\nTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
    "assignerShortName": "juniper",
    "cveId": "CVE-2025-59968",
    "datePublished": "2025-10-09T15:48:08.091Z",
    "dateReserved": "2025-09-23T18:19:06.955Z",
    "dateUpdated": "2025-10-09T16:03:31.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59968",
      "date": "2026-10-31",
      "epss": "0.00304",
      "percentile": "0.23248"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Junos Space Security Director",
                "vendor": "Juniper Networks",
                "versions": [
                  {
                    "lessThan": "24.1R3 Patch V4",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "cSRX"
                ],
                "product": "Junos OS",
                "vendor": "Juniper Networks",
                "versions": [
                  {
                    "status": "unaffected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "platforms": [
                  "vSRX Series",
                  "SRX Series"
                ],
                "product": "Junos OS",
                "vendor": "Juniper Networks",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              }
            ],
            "source": "sirt@juniper.net"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:juniper:space_security_director:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "089ADA2B-78A6-46F2-9560-B4EC849D394F",
                    "versionEndExcluding": "24.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:juniper:space_security_director:24.1:r1:*:*:*:*:*:*",
                    "matchCriteriaId": "DBDC52A5-EE95-40D7-870C-56AF400E0531",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:juniper:space_security_director:24.1:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "3C05DBD6-F4E6-4748-BBC9-CB0DF6ED3541",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:juniper:space_security_director:24.1:r3:*:*:*:*:*:*",
                    "matchCriteriaId": "B866E017-3B4A-4779-A736-5D68E544E93F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:juniper:vsrx:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36F68E75-E6C6-4DB4-AE0E-C5637ECE7C88",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx1500:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2CEBF85C-736A-4E7D-956A-3E8210D4F70B",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx1600:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE06B18-BFB5-4029-A05D-386CFBFBF683",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx2300:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "48A1DCCD-208C-46D9-8E14-89592B49AB9A",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx300:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BB5AB24B-2B43-43DD-AE10-F758B4B19F2A",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx320:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80F9DC32-5ADF-4430-B1A6-357D0B29DB78",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx340:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8B82D4C4-7A65-409A-926F-33C054DCBFBA",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx345:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CE535749-F4CE-4FFA-B23D-BF09C92481E5",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx380:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2305DA9D-E6BA-48F4-80CF-9E2DE7661B2F",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx4100:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3AA8999C-8AE4-416F-BA2A-B1A21F33B4D7",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx4120:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E5942B6E-AFC7-40E4-8007-68C804BD52E3",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx4200:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CCC5F6F5-4347-49D3-909A-27A3A96D36C9",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx4300:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "826F893F-7B06-43B5-8653-A8D9794C052E",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx4600:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "56BA6B86-D3F4-4496-AE46-AC513C6560FA",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx4700:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "462CFD52-D3E2-4F7A-98AC-C589D2420556",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx5400:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2FDDC897-747F-44DD-9599-7266F9B5B7B1",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx5600:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "68CA098D-CBE4-4E62-9EC0-43E1B6098710",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:juniper:srx5800:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "66F474D4-79B6-4525-983C-9A9011BD958B",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.\u00a0\n\n\n\n\nTampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls.\n\n\n\nThis issue affects Junos Space Security Director \n  *   all versions prior to 24.1R3 Patch V4\n\n\nThis issue does not affect managed cSRX Series devices."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de autorizaci\u00f3n faltante en Juniper Networks Junos Space Security Director permite a un atacante no autenticado basado en red leer o modificar metadatos a trav\u00e9s de la interfaz web.\n\nLa manipulaci\u00f3n de estos metadatos puede resultar en que los dispositivos gestionados de la serie SRX permitan tr\u00e1fico de red que de otro modo deber\u00eda ser bloqueado por pol\u00edtica, eludiendo eficazmente los controles de seguridad previstos.\n\nEste problema afecta a Junos Space Security Director\n* todas las versiones anteriores a 24.1R3 Parche V4\n\nEste problema no afecta a los dispositivos gestionados de la serie cSRX."
          }
        ],
        "id": "CVE-2025-59968",
        "lastModified": "2026-10-18T21:10:00.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.0,
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "YES",
                "Recovery": "AUTOMATIC",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "GREEN",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Green",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "source": "sirt@juniper.net",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59968",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-09T16:03:14.737515Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-09T16:15:46.837",
        "references": [
          {
            "source": "sirt@juniper.net",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://supportportal.juniper.net/JSA103157"
          },
          {
            "source": "sirt@juniper.net",
            "tags": [
              "Technical Description"
            ],
            "url": "https://www.juniper.net/documentation/us/en/software/nm-apps24.1/junos-space-security-director/topics/task/junos-space-metadata-creating.html"
          }
        ],
        "sourceIdentifier": "sirt@juniper.net",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-10-10T16:20:11+00:00",
      "cve": "CVE-2025-59968",
      "id": "CVE-2025-59968",
      "initial_release_date": "2025-10-08T16:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Junos Space Security Director: Insufficient authorization for sensitive resources in web interface",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59968.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59968",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-09T16:03:14.737515Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-09T16:03:16.938Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Junos Space Security Director",
              "vendor": "Juniper Networks",
              "versions": [
                {
                  "lessThan": "24.1R3 Patch V4",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "cSRX"
              ],
              "product": "Junos OS",
              "vendor": "Juniper Networks",
              "versions": [
                {
                  "status": "unaffected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "platforms": [
                "vSRX Series",
                "SRX Series"
              ],
              "product": "Junos OS",
              "vendor": "Juniper Networks",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRequired Configuration for Exposure:\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\u003c/span\u003eCreate a Metadata using the Create Metadata administrative page."
                }
              ],
              "value": "Required Configuration for Exposure:\u00a0\nCreate a Metadata using the Create Metadata administrative page."
            }
          ],
          "datePublic": "2025-10-08T16:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cdiv\u003eA Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eTampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eThis issue affects Junos Space Security Director \u003cbr\u003e\u003cul\u003e\u003cli\u003e all versions prior to 24.1R3 Patch V4\u003c/li\u003e\u003c/ul\u003eThis issue does not affect managed cSRX Series devices.\u003cbr\u003e\u003c/div\u003e"
                }
              ],
              "value": "A Missing Authorization vulnerability in the Juniper Networks Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface.\u00a0\n\n\n\n\nTampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls.\n\n\n\nThis issue affects Junos Space Security Director \n  *   all versions prior to 24.1R3 Patch V4\n\n\nThis issue does not affect managed cSRX Series devices."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
                }
              ],
              "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV4_0": {
                "Automatable": "YES",
                "Recovery": "AUTOMATIC",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "providerUrgency": "GREEN",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "HIGH",
                "userInteraction": "NONE",
                "valueDensity": "CONCENTRATED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/AU:Y/R:A/V:C/RE:M/U:Green",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "MODERATE"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE\u2011862: Missing Authorization",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-09T15:48:08.091Z",
            "orgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
            "shortName": "juniper"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://supportportal.juniper.net/JSA103157"
            },
            {
              "tags": [
                "technical-description"
              ],
              "url": "https://www.juniper.net/documentation/us/en/software/nm-apps24.1/junos-space-security-director/topics/task/junos-space-metadata-creating.html"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cdiv\u003eThe following software releases have been updated to resolve this specific issue:\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eJunos Space Security Director: 24.1R3 Patch V4, 24.1R4\u0026nbsp;and all subsequent releases.\u003c/div\u003e"
                }
              ],
              "value": "The following software releases have been updated to resolve this specific issue:\u00a0\n\n\n\n\nJunos Space Security Director: 24.1R3 Patch V4, 24.1R4\u00a0and all subsequent releases."
            }
          ],
          "source": {
            "advisory": "JSA103157",
            "defect": [
              "1867545"
            ],
            "discovery": "USER"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2025-10-08T16:00:00.000Z",
              "value": "Initial Publication"
            }
          ],
          "title": "Junos Space Security Director: Insufficient authorization for sensitive resources in web interface",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "There are no known workarounds for this issue.\u003cbr\u003eTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.\u003cbr\u003e\u003cbr\u003e"
                }
              ],
              "value": "There are no known workarounds for this issue.\nTo reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8cbe9d5a-a066-4c94-8978-4b15efeae968",
        "assignerShortName": "juniper",
        "cveId": "CVE-2025-59968",
        "datePublished": "2025-10-09T15:48:08.091Z",
        "dateReserved": "2025-09-23T18:19:06.955Z",
        "dateUpdated": "2025-10-09T16:03:31.610Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.