CVE-2025-11198— Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-11198
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server
Source: NVD (National Vulnerability Database)
Vulnerability Description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. This issue affects Security Director Policy Enforcer: * All versions before 23.1R1 Hotpatch v3. This issue does not affect Junos Space Security Director Insights.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
关键功能的认证机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juniper Security Director Policy Enforcer 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Security Director Policy Enforcer是美国瞻博（Juniper）公司的一个实现安全策略的集中下发与威胁响应自动化的模块。 Juniper Security Director Policy Enforcer 23.1R1 Hotpatch v3之前版本存在访问控制错误漏洞，该漏洞源于缺少关键功能身份验证，可能导致未经身份验证的攻击者替换合法vSRX镜像。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Security Director Policy Enforcer | 0 ~ 23.1R1 Hotpatch v3 | - |
II. Public POCs for CVE-2025-11198
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-11198
请登录查看更多情报信息。
Same Patch Batch · Juniper Networks · 2025-10-09 · 40 CVEs total
| CVE-2025-59978 | 9.0 CRITICAL | Junos Space: Stored cross-site scripting vulnerability in web application |
| CVE-2025-59968 | 8.6 HIGH | Junos Space Security Director: Insufficient authorization for sensitive resources in web i |
| CVE-2025-59974 | 8.4 HIGH | Junos Space Security Director: Persistent Cross-Site Scripting (XSS) vulnerability |
| CVE-2025-60004 | 7.5 HIGH | Junos OS and Junos OS Evolved: Specific BGP EVPN update message causes rpd crash |
| CVE-2025-59964 | 7.5 HIGH | Junos OS: SRX4700: When forwarding-options sampling is enabled any traffic destined to the |
| CVE-2025-59975 | 7.5 HIGH | Junos Space: Flooding device with inbound API calls leads to WebUI and CLI management acce |
| CVE-2025-59957 | 6.8 MEDIUM | Junos OS: EX4600 Series and QFX5000 Series: An attacker with physical access can open a pe |
| CVE-2025-52961 | 6.5 MEDIUM | Junos OS Evolved: PTX Series except PTX10003: An unauthenticated adjacent attacker sending |
| CVE-2025-59980 | 6.5 MEDIUM | Junos OS: When a user with the name ftp or anonymous is configured unauthenticated filesys |
| CVE-2025-59976 | 6.5 MEDIUM | Junos Space: Arbitrary file download vulnerability in web interface |
| CVE-2025-59967 | 6.5 MEDIUM | Junos OS Evolved: ACX7024, ACX7024X, ACX7100-32C, ACX7100-48L, ACX7348, ACX7509: When spe |
| CVE-2025-59958 | 6.5 MEDIUM | Junos OS Evolved: PTX Series: When a firewall filter rejects traffic these packets are err |
| CVE-2025-60009 | 6.1 MEDIUM | Junos Space: CLI Configlet page is vulnerable to reflected cross-site script injection |
| CVE-2025-59981 | 6.1 MEDIUM | Junos Space: Device Template Definition page is vulnerable to reflected cross-site script |
| CVE-2025-59982 | 6.1 MEDIUM | Junos Space: Dashboard Search field is vulnerable to reflected cross-site script injection |
| CVE-2025-59983 | 6.1 MEDIUM | Junos Space: Template Definition page is vulnerable to reflected cross-site script injecti |
| CVE-2025-59984 | 6.1 MEDIUM | Junos Space: Global Search is vulnerable to reflected cross-site script injection |
| CVE-2025-59985 | 6.1 MEDIUM | Junos Space: Purging Policy field is vulnerable to reflected cross-site script injection |
| CVE-2025-59986 | 6.1 MEDIUM | Junos Space: Input fields in Model Devices are vulnerable to reflected cross-site script i |
| CVE-2025-59988 | 6.1 MEDIUM | Junos Space: Generate Report page is vulnerable to reflected cross-site script injection |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Juniper Networks
- CVE-2026-33791
Junos OS and Junos OS Evolved: Execution of crafted CLI comm - CVE-2026-33790
Junos OS: SRX Series: In a NAT64 configuration, receipt of a - CVE-2026-33787
Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specifi - CVE-2026-33785
Junos OS: MX Series: Missing Authorization for specific 'req - CVE-2026-33784
JSI Virtual Lightweight Collector: Default password is not r
Same weakness: CWE-306
- CVE-2021-47940
WordPress Download From Files 1.48 Arbitrary File Upload - CVE-2021-47936
OpenCATS 0.9.4 Remote Code Execution via Resume Upload - CVE-2021-47933
WordPress MStore API 2.0.6 Arbitrary File Upload - CVE-2026-8185
UGREEN CM933 Administrative missing authentication - CVE-2026-42302
FastGPT: Unauthenticated Remote Code Execution (RCE) via cod
V. Comments for CVE-2025-11198
No comments yet