

China-Linked Silk Typhoon Targets IT Supply Chains in Latest Cyber Attacks
March 6, 2025
Remote Attackers Can Exploit Cisco Webex for BroadWorks Vulnerability to Access Data and Credentials
March 6, 2025
China-Linked Silk Typhoon Targets IT Supply Chains in Latest Cyber Attacks
March 6, 2025
Remote Attackers Can Exploit Cisco Webex for BroadWorks Vulnerability to Access Data and Credentials
March 6, 2025Severity
High
Analysis Summary
CVE-2025-21589 CVSS:9.8
Juniper Networks Session Smart Router, Session Smart Conductor and WAN Assurance Managed Routers are vulnerable to an authentication bypass using an alternate path or channel vulnerability. A remote attacker could bypass authentication and take administrative control of the device.
CVE-2024-39564 CVSS:7.5
This is a similar, but different vulnerability than the issue reported as CVE-2024-39549. A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update which allocates memory used to log the bad path attribute. This double free of memory is causing an rpd crash, leading to a Denial of Service (DoS). This issue affects: Junos OS: * from 22.4 before 22.4R3-S4.
Impact
- Security Bypass
- Denial of Service
Indicators of Compromise
CVE
CVE-2025-21589
CVE-2024-39564
Affected Vendors
Affected Products
- Juniper Networks Session Smart Router - 5.6.7
- Juniper Networks Session Smart Router - 6.0.8
- Juniper Networks Session Smart Router - 6.2
- Juniper Networks Session Smart Conductor - 6.1
- Juniper Networks Session Smart Conductor - 6.2
- Juniper Networks Session Smart Conductor - 5.6.7
- Juniper Networks Session Smart Conductor - 6.0.8
- Juniper Networks WAN Assurance Managed Routers- 5.6.7
- Juniper Networks WAN Assurance Managed Routers- 6.0.8
- Juniper Networks WAN Assurance Managed Routers- 6.1
- Juniper Networks WAN Assurance Managed Routers- 6.2
- Juniper Networks WAN Assurance Managed Routers- 6.3
- Juniper Networks Junos OS Evolved - 22.4
- Juniper Networks Junos OS - 22.4
Remediation
Refer to Juniper Networks Security Advisory for patch, upgrade, or suggested workaround information.