EUVD-2026-21088
GHSA-9hcr-jp7m-44jv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it.
When an SRX device is provisioned to connect to Security Director (SD) cloud, it doesn't perform sufficient verification of the received server certificate. This allows a PITM to intercept the communication between the SRX and SD cloud and access credentials and other sensitive information.
This issue affects Junos OS:
- all versions before 22.4R3-S9,
- 23.2 versions before 23.2R2-S6,
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2-S3,
- 24.4 versions before 24.4R2-S2,
- 25.2 versions before 25.2R1-S2, 25.2R2.
AnalysisAI
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Technical ContextAI
CWE-296: Improper Following of Certificate Chain of Trust. J-Web provisioning client omits critical X.509 certificate chain verification steps when establishing TLS sessions to Security Director cloud infrastructure. Missing hostname validation, certificate authority trust path verification, or certificate revocation checks enable TLS session hijacking. Network protocol implementation flaw specific to SRX SD cloud integration component, not general J-Web certificate handling.
RemediationAI
Vendor-released patches: upgrade to Junos OS 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, 25.2R1-S2, or 25.2R2 depending on current branch. Prioritize devices actively provisioned for Security Director cloud connectivity. Interim mitigation: disable automatic SD cloud provisioning via J-Web if not operationally required, restrict management network access to trusted segments, deploy network-based TLS inspection to detect anomalous certificate chains on SRX management traffic. Monitor for unexpected certificate changes in SD cloud sessions. Official vendor advisory with detailed upgrade paths: https://kb.juniper.net/JSA107823
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users t
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today