PT-2025-41398 · Vmware+1 · Vmware Nsx+2

Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-11198

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions Juniper Networks Security Director Policy Enforcer versions prior to 23.1R1 Hotpatch v3

Description A missing authentication check for a critical function in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. Specifically, if a trusted user initiates deployment, the Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. The system does not verify the identity of the entity uploading or deploying images, enabling malicious actors to inject compromised images into the deployment pipeline.

Recommendations Update to version 23.1R1 Hotpatch v3.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-11198

Affected Products

Security Director Policy Enforcer

Vmware Nsx

Vsrx

References · 8

• https://supportportal.juniper.net/JSA103437 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-11198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11198 · Security Note
• https://twitter.com/CveTodo/status/1976324814643065162 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1976325182554828938 · Twitter Post
• https://t.me/CVEtracker/34527 · Telegram Post
• https://twitter.com/CveFindCom/status/1976319299967947257 · Twitter Post
• https://twitter.com/CVEnew/status/1976328964663804152 · Twitter Post