CVE-2025-11198: Juniper Policy Enforcer Auth Bypass Flaw

CVE-2025-11198 Overview

A Missing Authentication for Critical Function vulnerability (CWE-306) has been identified in Juniper Networks Security Director Policy Enforcer. This flaw allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. When a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one, enabling supply chain compromise of virtualized security infrastructure.

Critical Impact

Unauthenticated attackers can substitute legitimate vSRX security appliance images with malicious versions, compromising the integrity of deployed virtual security appliances across VMware NSX environments.

Affected Products

• Juniper Security Director Policy Enforcer - All versions before 23.1R1 Hotpatch v3
• Juniper Security Director Policy Enforcer 23.1R1
• Juniper Security Director Policy Enforcer 23.1R1 Hotpatch v1 and v2

Discovery Timeline

• 2025-10-09 - CVE-2025-11198 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-11198

Vulnerability Analysis

This vulnerability represents a critical authentication bypass in the vSRX image management functionality of Juniper Security Director Policy Enforcer. The system fails to implement proper authentication controls for the image upload and replacement function, which is a critical operation in the security appliance deployment pipeline.

The attack leverages the trust relationship between Security Director Policy Enforcer and VMware NSX. When administrators deploy vSRX virtual security appliances, they expect the system to deliver verified, legitimate images. However, due to the missing authentication, an attacker positioned on the network can intercept this process and substitute malicious images without credentials.

This is particularly dangerous because the vSRX is a virtualized firewall/security appliance. Compromising the image being deployed means the attacker can embed backdoors, disable security controls, or install monitoring capabilities directly into what administrators believe is a trusted security device.

Root Cause

The root cause is classified as CWE-306: Missing Authentication for Critical Function. The vSRX image upload and replacement API endpoint in Security Director Policy Enforcer does not require authentication, allowing any network-accessible attacker to upload arbitrary images. This critical oversight in the security architecture permits unauthenticated access to a function that should be restricted to authenticated administrators only.

Attack Vector

The attack is network-based and requires no authentication or special privileges. An attacker with network access to the Security Director Policy Enforcer can:

1. Identify the vulnerable image upload endpoint
2. Upload a malicious vSRX image to replace legitimate versions
3. Wait for an administrator to initiate a deployment
4. The malicious image is automatically delivered to VMware NSX instead of the legitimate image

The attack requires user interaction (a trusted user must initiate deployment), but the attacker's malicious image substitution happens transparently. The legitimate user has no indication that a compromised image is being deployed.

Detection Methods for CVE-2025-11198

Indicators of Compromise

• Unexpected changes to vSRX image files or checksums stored in Security Director Policy Enforcer
• Unauthenticated connections or API calls to the image management endpoints
• Image upload operations from unexpected source IP addresses or without corresponding administrator sessions
• Hash mismatches between deployed vSRX images and known-good vendor baselines

Detection Strategies

• Implement network monitoring to detect unauthenticated access attempts to Security Director Policy Enforcer management interfaces
• Deploy integrity monitoring for vSRX image repositories to detect unauthorized modifications
• Review Security Director Policy Enforcer logs for image upload events that lack corresponding authenticated administrator sessions
• Monitor VMware NSX deployment logs for discrepancies between expected and deployed image signatures

Monitoring Recommendations

• Enable comprehensive audit logging on Security Director Policy Enforcer API endpoints
• Implement file integrity monitoring (FIM) on directories containing vSRX images
• Establish baseline checksums for all legitimate vSRX images and alert on any deviations
• Monitor network traffic to/from Security Director Policy Enforcer for anomalous patterns

How to Mitigate CVE-2025-11198

Immediate Actions Required

• Upgrade Juniper Security Director Policy Enforcer to version 23.1R1 Hotpatch v3 or later immediately
• Implement network segmentation to restrict access to Security Director Policy Enforcer management interfaces
• Verify the integrity of all existing vSRX images against known-good Juniper checksums
• Audit recent deployment activities for signs of image tampering

Patch Information

Juniper Networks has released 23.1R1 Hotpatch v3 to address this vulnerability. Organizations should apply this patch as a priority. Detailed patch information is available in the Juniper Security Advisory JSA103437.

Note: Junos Space Security Director Insights is not affected by this vulnerability.

Workarounds

• Restrict network access to Security Director Policy Enforcer to trusted management networks only using firewall rules
• Implement manual image verification procedures by comparing checksums before any vSRX deployment
• Deploy network access control lists (ACLs) to limit which systems can communicate with the Policy Enforcer image management interfaces
• Consider temporarily suspending automated vSRX deployments until the patch is applied

# Example: Restrict access to Security Director Policy Enforcer management interface
# Add firewall rules to limit access to trusted administrator networks only
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP