Introduction
Attackers can silently replace trusted firewall images in virtualized environments without ever holding valid credentials, and that can lead to widespread compromise. CVE-2025-11198 is a missing-authentication vulnerability in Juniper Networks Security Director Policy Enforcer, a core component for orchestrating security in VMware NSX deployments. It exposes critical infrastructure to remote, unauthenticated manipulation.
About the involved software: Juniper Networks sells networking and security products, including routers, switches, firewalls, and management platforms. Security Director Policy Enforcer is an orchestration tool that automates security policy deployment across hybrid and virtualized environments. It integrates with VMware NSX to provision firewalls dynamically. Because it manages security at scale, a vulnerability in this platform matters most to large enterprises and service providers.
Technical Information
CVE-2025-11198 comes from missing authentication checks on critical API endpoints in Security Director Policy Enforcer. The APIs that manage vSRX firewall images require no authentication at all, so any attacker with network access can upload or replace those images. The attacker does not need stolen credentials or a chain of vulnerabilities. Sending crafted requests to the exposed API is enough.
Exploitation works like this:
- An attacker with network access to the Policy Enforcer management interface uploads a malicious vSRX image through the unauthenticated API.
- The image is stored alongside the legitimate images, and the management interface shows no difference between them.
- Later, a trusted administrator starts a deployment, such as provisioning new firewall instances in VMware NSX, and Policy Enforcer delivers the attacker's image to NSX.
- The malicious image now runs as a production firewall, potentially with backdoors or altered inspection logic.
The image management functions have no authentication whatsoever, a textbook case of CWE-306 (Missing Authentication for Critical Function). The endpoints perform no credential checks, session validation, or authorization. A remote, unauthenticated attacker needs only network-level access to the management interface.
Public sources do not yet include code snippets or further implementation details.
Affected Systems and Versions
- Product: Juniper Networks Security Director Policy Enforcer
- Affected versions: All versions prior to 23.1R1 Hotpatch v3
- Not affected: Junos Space Security Director Insights
- Vulnerable configuration: Any deployment where the Policy Enforcer management interface is accessible over the network
Vendor Security History
Juniper Networks is known for the security features in its products, particularly the SRX Series firewalls. Its management platforms, though, have had recurring critical vulnerabilities, including authentication and resource management flaws. Juniper responded to CVE-2025-11198 promptly and released a hotpatch in the same bulletin cycle. Earlier advisories, such as the one for CVE-2025-59975 (uncontrolled resource consumption in Junos Space), show ongoing attention to management interface security. They also show that these interfaces still need close watching.
