Product:
Junos Space Security Director
Summary
A Missing Authorization vulnerability in Junos Space Security Director allows an unauthenticated network-based attacker to read or modify metadata via the web interface. Tampering with this metadata can result in managed SRX Series devices permitting network traffic that should otherwise be blocked by policy, effectively bypassing intended security controls. This issue affects all versions prior to 24.1R3 Patch V4.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2025-59968 |
Exploitation
An attacker can exploit this vulnerability by accessing the web interface of Junos Space Security Director without authentication. By manipulating the metadata, the attacker can alter the behavior of managed SRX Series devices, allowing unauthorized network traffic to pass through security policies that should block it. This can lead to significant security breaches as the intended security controls are bypassed.
Affected Products
- Junos Space Security Director: All versions prior to 24.1R3 Patch V4 are affected by this vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to Junos Space Security Director version 24.1R3 Patch V4 or later. Additionally, ensure that access to the web interface is restricted to authenticated users only, and implement monitoring to detect any unauthorized access attempts.