Brief Summary: Juniper Apstra CVE-2025-13914 SSH MITM Vulnerability Enables Device Impersonation and Credential Theft

Introduction

Juniper Networks Apstra is missing an SSH host key validation step, so every outbound SSH session from the automation platform to a managed network device could be silently intercepted. An attacker who does that can impersonate infrastructure and harvest credentials. For organizations running Apstra to automate data center networks, this flaw (scored CVSS 8.7) turns the management plane itself into a liability.

Juniper Apstra is a data center network automation platform that network architects use to design, validate, and manage network infrastructure at scale. Now part of Hewlett Packard Enterprise following Juniper's integration, Apstra is a significant platform for intent-based networking in enterprise and service provider data centers. A flaw in its SSH implementation bears directly on the integrity of the entire managed device fleet.

Technical Information

Root Cause

CVE-2025-13914 is classified under CWE-322: Key Exchange without Entity Authentication. When Apstra's SSH client opened outbound connections to managed devices, it did not adequately verify the remote host's identity during the SSH key exchange. The Apstra server would establish SSH sessions without checking host keys against a known or trusted set of values. That violates the foundation of the SSH protocol's security model, because host key verification is the mechanism that prevents impersonation of the remote endpoint.

CVSS Breakdown

The CVSS v3.1 vector string for this vulnerability is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

The scope is "Changed" because the vulnerable component is the Apstra server's SSH client, but successful exploitation reaches the managed devices and the credentials used to access them. The blast radius extends beyond Apstra itself.

Attack Flow

Exploitation follows this sequence:

1. Positioning: The attacker first needs a machine-in-the-middle position on the network path between the Apstra server and one or more managed devices. They could get there through ARP spoofing, BGP hijacking, compromising an intermediate network device, or physical access to the network segment that carries management traffic.

2. Interception: The attacker intercepts an outbound SSH connection from the Apstra server to a managed device. Apstra does not validate the host key presented during the SSH handshake, so the attacker can present their own key without triggering any rejection or warning.

3. Impersonation: The attacker completes the SSH handshake with the Apstra server and, in effect, becomes the managed device. To Apstra, the session looks legitimate.

4. Credential Capture: During the authentication phase of the SSH session, the Apstra server sends the credentials it uses to authenticate to the managed device. The tunnel terminates at the attacker's system rather than the legitimate device, so the attacker captures those credentials in cleartext inside it.

5. Lateral Movement Potential: The attacker can then use the captured credentials to authenticate directly to managed devices, potentially gaining administrative control over network infrastructure.

Attack complexity is rated High because the attacker must get on-path first. After that, no further privileges or user interaction are needed, and without host key validation there is no cryptographic barrier to the impersonation.

Vulnerable Flow

The vulnerable flow is outbound SSH from the Apstra server to managed devices. Apstra uses this control channel to push configuration, collect telemetry, and manage the lifecycle of network devices. An attacker who compromises it can see and control the automation platform's interactions with the entire managed fleet.

Patch Information

Juniper Networks has fixed CVE-2025-13914 in Apstra version 6.1.1 and all later releases. The fix, tracked internally as issue AOS-56131, adds proper SSH host key validation for connections from the Apstra server to managed network devices.

Before version 6.1.1, Apstra's SSH implementation would silently carry on with the key exchange even when it received an unknown or spoofed host key. With the fix, the Apstra server validates SSH host keys before it completes the key exchange and establishes a session. If an attacker intercepts the SSH handshake and presents a fraudulent host key, Apstra rejects the connection instead of silently proceeding.

The remediation in brief:

• All versions of Apstra prior to 6.1.1 are affected, starting from the very first release (version 0).
• No workarounds exist. Upgrading to 6.1.1 or later is the only remediation path.
• Juniper published its advisory (JSA107862) on April 8, 2026.
• At the time of disclosure, Juniper reported no known malicious exploitation of this vulnerability in the wild.

Organizations should freeze deployments on older versions and fast-track upgrade approvals for Apstra 6.1.1 or later.

Affected Systems and Versions

Every release of Juniper Networks Apstra before version 6.1.1 is vulnerable, from the initial release (version 0) up to but not including 6.1.1.

• Affected: Apstra versions 0 through 6.1.0 (inclusive)
• Fixed: Apstra version 6.1.1 and all subsequent releases

The vulnerable configuration is the default SSH implementation for outbound connections from the Apstra server to managed network devices. A deployment needs no special or non-default configuration to be vulnerable.

Vendor Security History

Juniper Networks, now part of Hewlett Packard Enterprise, has a history of security issues that drew threat actor attention. In 2023, Rapid7 documented confirmed real-world exploitation of vulnerabilities in Juniper SRX and EX series devices. No active exploitation of CVE-2025-13914 has been confirmed as of this writing, but the pattern of threat actors targeting Juniper infrastructure suggests organizations should patch now rather than wait for exploitation to begin.

Multiple international cybersecurity authorities, including GovCERT HK and CERT Austria, issued alerts about this vulnerability shortly after its disclosure, a sign that the security community is treating it seriously.

References

• Juniper Security Bulletin: Apstra SSH Host Key Validation Vulnerability (JSA107862)
• NVD Entry for CVE-2025-13914
• CVE Record for CVE-2025-13914
• Tenable CVE-2025-13914
• Juniper KB Article JSA107862
• GovCERT HK Alert: Juniper Networks Product Vulnerabilities
• CERT Austria Daily Summary, April 8, 2026
• Rapid7: Exploitation of Juniper Networks SRX and EX Series Devices (2023)