---
id: CVE-2025-11198
title: >-
  A Missing Authentication for Critical Function vulnerability in Juniper
  Networks Security Director Policy Enforcer allows an unauthenticated,
  network-based attacker to replace legitimate vSRX images with malicious ones.




  If a trusted u…
summary: >-
  A Missing Authentication for Critical Function vulnerability in Juniper
  Networks Security Director Policy Enforcer allows an unauthenticated,
  network-based attacker to replace legitimate vSRX images with malicious ones.




  If a trusted u…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N'
cwe:
  - CWE-306
vendor: juniper
product: security_director_policy_enforcer
affected:
  - security_director_policy_enforcer < 23.1
  - security_director_policy_enforcer = 23.1
patched:
  - security_director_policy_enforcer 23.1
published: '2025-10-09'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-11198'
references:
  - url: 'https://supportportal.juniper.net/JSA103437'
    label: sirt@juniper.net
tags:
  - nvd
epss: 0.00271
epssPercentile: 0.1749
ingestedAt: '2026-09-30T23:29:32.421Z'
---

## Overview

A Missing Authentication for Critical Function vulnerability in Juniper Networks Security Director Policy Enforcer allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones.



If a trusted user initiates deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one.





This issue affects Security Director Policy Enforcer:  



  *  All versions before 23.1R1 Hotpatch v3.


This issue does not affect Junos Space Security Director Insights.

## Affected

- `security_director_policy_enforcer < 23.1`
- `security_director_policy_enforcer = 23.1`

## Remediation

Upgrade past the affected range:

- `security_director_policy_enforcer 23.1`