CVE-2025-21589 IBM QRadar · QRadar

Detect Juniper Session Smart Router Authentication Bypass (CVE-2025-21589) in IBM QRadar

CVE-2025-21589 is a critical authentication bypass vulnerability (CWE-288, CVSS 9.8) in Juniper Networks Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router. An unauthenticated remote attacker can bypass authentication mechanisms to gain administrative access to the management interface without valid credentials. Affected versions include SSR 5.6.7–5.6.16, 6.0.x before 6.0.8, 6.1.x before 6.1.12-lts, 6.2.x before 6.2.8-lts, and 6.3.x before 6.3.3-r2. Exploitation grants full control of affected routers and conductors, enabling lateral movement, traffic interception, configuration tampering, and persistent backdoor establishment.

MITRE ATT&CK

Tactic
Initial Access Persistence Defense Evasion

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  eventcount,
  CATEGORYNAME(category) AS event_category,
  LOGSOURCENAME(logsourceid) AS log_source,
  "devicevendor",
  "deviceproduct",
  URL,
  "HTTP_USER_AGENT"
FROM events
WHERE
  LAST 24 HOURS
  AND (
    LOWER("devicevendor") LIKE '%juniper%'
    OR LOWER("deviceproduct") LIKE '%session smart%'
    OR LOWER("deviceproduct") LIKE '%ssr%'
    OR LOWER("deviceproduct") LIKE '%conductor%'
  )
  AND (
    destinationport IN (80, 443, 830, 8080, 8443, 4505, 4506)
    OR LOWER(URL) LIKE '%/api/v1%'
    OR LOWER(URL) LIKE '%/conductor%'
    OR LOWER(URL) LIKE '%/admin%'
  )
  AND (
    LOWER("HTTP_USER_AGENT") LIKE '%python%'
    OR LOWER("HTTP_USER_AGENT") LIKE '%curl%'
    OR LOWER("HTTP_USER_AGENT") LIKE '%wget%'
    OR LOWER("HTTP_USER_AGENT") LIKE '%go-http%'
    OR category IN (5018, 5019, 5021)
  )
GROUP BY sourceip, destinationip, destinationport
HAVING COUNT(*) >= 3
ORDER BY eventcount DESC
critical severity medium confidence

QRadar AQL query correlating authentication-related events, management port access, and suspicious HTTP clients against Juniper device log sources to surface potential CVE-2025-21589 exploitation attempts.

Data Sources

Juniper NSMSyslog from SSR/ConductorNetwork flow dataQRadar DSM for Juniper

Required Tables

events

False Positives & Tuning

  • Security monitoring tools with non-browser HTTP clients performing legitimate Juniper API health checks
  • Configuration management platforms (Ansible, Salt) accessing management endpoints
  • Scheduled automation accessing Juniper REST APIs for telemetry or reporting
  • Network operations center tools polling multiple Juniper devices from a single management IP

Other platforms for CVE-2025-21589

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated REST API Enumeration Against SSR Management Interface

    Expected signal: Multiple HTTP GET requests to management API paths from a single source IP within seconds; HTTP 200 or 401 responses logged in SSR access logs; no authentication token in request headers

  2. Test 2Authentication Bypass Attempt via Malformed Session Token

    Expected signal: Authentication audit events showing requests with malformed or absent credentials; REST API logs showing 200-series responses to authenticated endpoints without valid session; source IP making multiple rapid unauthenticated requests

  3. Test 3Post-Bypass Administrative Account Creation Simulation

    Expected signal: New user creation event in Juniper audit log; REST API POST to /api/v1/users followed by successful 201 response; new admin account appearing in user enumeration

Last updated: 2026-06-20 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify all Juniper Session Smart Router, Session Smart Conductor, and WAN Assurance Managed Router devices in your environment and confirm their software versions against affected ranges (5.6.7–5.6.16, 6.0.x<6.0.8, 6.1.x<6.1.12-lts, 6.2.x<6.2.8-lts, 6.3.x<6.3.3-r2).
  2. Review management interface access logs (SSH, HTTPS, REST API) for the past 72 hours for any sessions originating from unexpected source IPs, especially those lacking prior authentication history or using non-browser HTTP clients.
  3. Correlate source IPs from suspicious access events against threat intelligence feeds to determine if they are associated with known scanning infrastructure, VPN exit nodes, or Tor exit nodes.
  4. Check for any new administrator accounts, SSH keys, or API tokens created on affected devices since the vulnerability disclosure date (2025-09-10), which may indicate post-exploitation persistence.

Containment

  1. Immediately restrict access to Juniper management interfaces (ports 80, 443, 830, 8080, 8443) to trusted management network CIDRs only, using perimeter firewall ACLs or Juniper's own firewall filters, until patching is complete.
  2. If exploitation is suspected, isolate affected routers from the production network and redirect traffic through backup routing paths or unaffected devices. Revoke all active management sessions and rotate credentials for all accounts on affected systems.
  3. Apply vendor patches per JSA94663: upgrade to SSR 5.6.17+, 6.0.8+, 6.1.12-lts+, 6.2.8-lts+, or 6.3.3-r2+. For WAN Assurance Managed Routers, verify cloud-managed remediation through the Juniper Mist portal.

Evidence Collection

  1. Export full management interface access logs (syslog, REST API audit logs, SSH session logs) from all affected Juniper devices for the period 30 days prior to detection. Preserve raw log files with cryptographic hashes for chain of custody.
  2. Capture current running configuration, user account list, SSH authorized keys, and API token inventory from affected devices. Diff against last-known-good configuration backup to identify unauthorized changes.
  3. Collect network flow data (NetFlow/IPFIX) for management interface traffic to identify all source IPs that communicated with affected devices during the exposure window.

Escalation Criteria

  • !Escalate immediately to CISO and incident response team if any unauthorized administrator accounts, new SSH keys, or configuration changes are discovered on affected devices — these are indicators of successful exploitation and active compromise.
  • !Escalate if affected routers carry sensitive traffic segments (PCI-DSS cardholder data environments, healthcare networks, critical infrastructure OT/ICS connectivity) due to the potential for traffic interception and data exfiltration.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Juniper SSR/Conductor management audit logs at /var/log/128technology/ showing API calls without prior authentication events
  • >REST API access logs showing 200/201 responses to /api/v1/users, /api/v1/config, or /conductor/ endpoints without a preceding valid login
  • >SSH authorized_keys files on affected devices for unauthorized public key additions
  • >Running configuration diff revealing unauthorized BGP peers, route filters, or access control list modifications
  • >Network flow records showing persistent outbound connections from router management plane to external IPs (potential C2)

Tuning Guidance

Begin with a 30-day historical baseline of legitimate management interface source IPs and user agents to build an allowlist. Suppress alerts from known management IP ranges (jump hosts, NOC workstations, monitoring platforms) and automation service accounts. Increase confidence threshold by requiring both a suspicious user agent AND a successful 200-series response to a sensitive API path within the same session window. In environments with Juniper WAN Assurance (cloud-managed), exclude Juniper's own cloud management IPs which will generate legitimate API traffic. Tune the risk score threshold based on observed false-positive volume during the first week of deployment.

Hunting Queries

Hunt for authentication anomalies on Juniper devices over the past 30 days — specifically source IPs with bypass events or suspicious success-without-failure patterns that may indicate exploitation of CVE-2025-21589.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor =~ "Juniper" or DeviceProduct has_any ("Session Smart", "SSR", "Conductor")
| where Activity has_any ("login", "auth", "session", "admin")
| summarize LoginCount = countif(Activity has "success"), FailCount = countif(Activity has "fail"), BypassCount = countif(Activity has_any ("bypass", "unauthenticated")) by SourceIP, bin(TimeGenerated, 1d)
| where BypassCount > 0 or (LoginCount > 0 and FailCount == 0)
| project TimeGenerated, SourceIP, LoginCount, FailCount, BypassCount
Hunting — SPL
spl 
index=juniper OR index=network sourcetype=juniper:junos:syslog OR sourcetype=juniper:ssr
| eval day=strftime(_time, "%Y-%m-%d")
| stats count(eval(match(action, "success|login_ok"))) AS successes, count(eval(match(action, "fail|denied"))) AS failures, count(eval(match(action, "bypass|unauthenticated"))) AS bypasses BY src_ip, day
| where bypasses > 0 OR (successes > 0 AND failures = 0)
| table day, src_ip, successes, failures, bypasses
| sort -bypasses

Atomic Red Team Tests

Test 1 Unauthenticated REST API Enumeration Against SSR Management Interface
linux

Simulates an attacker probing the Juniper SSR management REST API without credentials to identify bypass-vulnerable endpoints, mimicking reconnaissance phase of CVE-2025-21589 exploitation.

Command

bash 
TARGET_IP="192.168.100.10"; for endpoint in "/api/v1/users" "/api/v1/config" "/conductor/api" "/admin" "/login" "/api/v1/system/info"; do echo "--- Testing $endpoint ---"; curl -sk -o /dev/null -w "HTTP %{http_code} - Size: %{size_download}\n" "https://$TARGET_IP$endpoint"; done

Cleanup

bash 
No cleanup required — read-only probe. Review target device access logs and remove test entries if populated.

Expected Telemetry

Multiple HTTP GET requests to management API paths from a single source IP within seconds; HTTP 200 or 401 responses logged in SSR access logs; no authentication token in request headers

Expected Detection

Alert triggered by >3 management API requests from a single source IP without authentication headers; suspicious user agent (curl) accessing sensitive paths

Test 2 Authentication Bypass Attempt via Malformed Session Token
linux

Tests the CVE-2025-21589 authentication bypass by sending requests with malformed or empty session tokens to the Juniper SSR management API, simulating CWE-288 exploitation in a lab environment.

Command

bash 
TARGET_IP="192.168.100.10"; echo '[*] Testing null token bypass...'; curl -sk -H 'Authorization: Bearer ' -H 'Content-Type: application/json' -w "\nHTTP Status: %{http_code}\n" "https://$TARGET_IP/api/v1/users"; echo '[*] Testing empty auth header bypass...'; curl -sk -H 'Authorization:' -w "\nHTTP Status: %{http_code}\n" "https://$TARGET_IP/api/v1/config"; echo '[*] Testing missing auth header...'; curl -sk -w "\nHTTP Status: %{http_code}\n" "https://$TARGET_IP/api/v1/system/info"

Cleanup

bash 
No persistent state created. Document HTTP response codes and compare against patched version behavior.

Expected Telemetry

Authentication audit events showing requests with malformed or absent credentials; REST API logs showing 200-series responses to authenticated endpoints without valid session; source IP making multiple rapid unauthenticated requests

Expected Detection

SIEM alert for successful HTTP responses (200/302) to admin API paths without valid authentication headers; risk score threshold triggered by combination of missing auth and admin path access

Test 3 Post-Bypass Administrative Account Creation Simulation
linux

Simulates the post-exploitation phase of CVE-2025-21589 where an attacker who successfully bypassed authentication creates a backdoor administrator account on the Juniper SSR for persistent access.

Command

bash 
TARGET_IP="192.168.100.10"; BYPASS_TOKEN="obtained_from_bypass"; echo '[*] Attempting to create backdoor admin account...'; curl -sk -X POST "https://$TARGET_IP/api/v1/users" -H "Authorization: Bearer $BYPASS_TOKEN" -H "Content-Type: application/json" -d '{"username": "svc_monitor", "password": "Juniper@2025!", "role": "admin", "description": "Monitoring service account"}' -w "\nHTTP Status: %{http_code}\n"; echo '[*] Verifying account creation...'; curl -sk "https://$TARGET_IP/api/v1/users" -H "Authorization: Bearer $BYPASS_TOKEN" | python3 -c "import sys,json; users=json.load(sys.stdin); [print(u.get('username','')) for u in users.get('users',[])]"

Cleanup

bash 
DELETE created account: curl -sk -X DELETE "https://$TARGET_IP/api/v1/users/svc_monitor" -H "Authorization: Bearer $BYPASS_TOKEN". Verify deletion and audit all accounts on device post-test.

Expected Telemetry

New user creation event in Juniper audit log; REST API POST to /api/v1/users followed by successful 201 response; new admin account appearing in user enumeration

Expected Detection

Alert on new administrator account creation outside of change management windows; alert on API-based user creation events from non-management source IPs; playbook triage step flags new accounts created post-disclosure

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0005Defense Evasion

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1556Modify Authentication Process

Same Tactic: Initial Access

Popular Detections