Vulnerability · Published Jul 11, 2025 · Assigned by juniper

CVE-2025-52950Juniper Security Director: Insufficient authorization for multiple endpoints in web interface

Critical 9.6

In plain English

A critical-severity missing authorization in Juniper Security Director from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A Missing Authorization vulnerability in Juniper Networks Security Director allows an unauthenticated network-based attacker to read or tamper with multiple sensitive resources via the web interface. Numerous endpoints on the Juniper Security Director appliance do not validate authorization and will deliver information to the caller that is outside their authorization level. An attacker can access data that is outside the user's authorization level. The information obtained can be used to gain access to additional information or perpetrate other attacks, impacting downstream managed devices. This issue affects Security Director version 24.4.1.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Juniper Security Director	24.4.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

References

https://supportportal.juniper.net/JSA100054 vendor-advisory