CVE-2025-21589
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.
This issue affects Session Smart Router:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Session Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.
This issue affects Session Smart Router:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2.
- Record
CVE-2025-21589- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
EUVDEUVD-2025-206381
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.
This issue affects Session Smart Router:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2.
- Record
EUVD-2025-206381- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vjjg-c428-g9r3
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks...
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.
This issue affects Session Smart Router:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2.
- Record
GHSA-vjjg-c428-g9r3- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device.
This issue affects Session Smart Router:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects Session Smart Conductor:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2;
This issue affects WAN Assurance Managed Routers:
-
from 5.6.7 before 5.6.17,
-
from 6.0 before 6.0.8 (affected from 6.0.8),
-
from 6.1 before 6.1.12-lts,
-
from 6.2 before 6.2.8-lts,
-
from 6.3 before 6.3.3-r2.
- Record
CVE-2025-21589- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-288
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-21589 is a critical vulnerability (CVSS 9.3) in Juniper Networks Session Smart Conductor, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. No source names a fixed version.