CVE-2025-21589: juniper networks session smart conductor

Vulnerability summary

CVE-2025-21589 is a critical (CVSS 9.8) vulnerability in juniper networks session smart conductor. EPSS estimates a 1.57% chance of exploitation in the next 30 days, higher than 75% of scored vulnerabilities.

Timeline

1. 27-01-2026
   PublishedVulnerability first disclosed.
2. 27-01-2026
   Last modifiedVulnerability information updated.

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypass authentication and take administrative control of the device. This issue affects Session Smart Router: * from 5.6.7 before 5.6.17, * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts, * from 6.2 before 6.2.8-lts, * from 6.3 before 6.3.3-r2; This issue affects Session Smart Conductor: * from 5.6.7 before 5.6.17, * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts, * from 6.2 before 6.2.8-lts, * from 6.3 before 6.3.3-r2; This issue affects WAN Assurance Managed Routers: * from 5.6.7 before 5.6.17, * from 6.0 before 6.0.8 (affected from 6.0.8), * from 6.1 before 6.1.12-lts, * from 6.2 before 6.2.8-lts, * from 6.3 before 6.3.3-r2.

• CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.