← CVE Intelligence

CVE-2025-11198

Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server PUBLISHED

Description (CNA)

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. This issue affects Security Director Policy Enforcer:   * All versions before 23.1R1 Hotpatch v3. This issue does not affect Junos Space Security Director Insights.

Affected (CNA)

Vendor / productVersions
Juniper Networks / Security Director Policy Enforceraffected 0 before 23.1R1 Hotpatch v3

CWE

CWE-306

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.