CVE-2025-52950: Juniper Security Director: Insufficient authorization for multiple endpoints in web interface
This Juniper advisory covers CVE-2025-52950 in Juniper Security Director.
- CVE-2025-52950
Key facts
- Vendor rating
- Critical, CVSS 9.6
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:H/SA:H· base score 6.4, scored by juniperAttack vector: network. Attack complexity: low. Attack requirements: none. Privileges required: low. User interaction: none. Confidentiality impact on the vulnerable system: low. Integrity impact on the vulnerable system: low. Availability impact on the vulnerable system: none. Confidentiality impact on subsequent systems: none. Integrity impact on subsequent systems: high. Availability impact on subsequent systems: high.- Weakness
- CWE-862 Missing Authorization
- CISA SSVC
- Exploitation: none observed. Automatable: yes. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Juniper Security Director 24.4.1
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple sensitive resources via the web interface.
Numerous endpoints on the Juniper Security Director appliance do not validate authorization and will deliver information to the caller that is outside their authorization level. An attacker can access data that is outside the user's authorization level.
The information obtained can be used to gain access to additional information or perpetrate other attacks, impacting downstream managed devices.
This issue affects Security Director version 24.4.1.
Text from the source record.
- Juniper Security Director 24.4.1
Official advisory · high-confidence parse· fetched ·verify at source
More Juniper Networks advisories
CVE-2026-106079Oct 28, 2026Session Smart Router command injectionCVE-2026-103411Oct 28, 2026Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session SmartCVE-2026-103410Oct 28, 2026Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks SessionCVE-2026-103409Oct 28, 2026Session Smart Router authentication bypassCVE-2026-103408Oct 28, 2026Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session SmartCVE-2026-103407Oct 28, 2026Session Smart Router path traversal
Juniper Networks advisories, July 2025All Juniper Networks advisories
Get an email when Juniper publishes the next one.
See Juniper's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Juniper Networks CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
