Juniper Networks Security Director Policy Enforcer Missing Authentication Vulnerability Allowing Malicious vSRX Image Deployment

A vulnerability allowing missing authentication for critical functions has been identified in Juniper Networks Security Director Policy Enforcer, all versions prior to 23.1R1 Hotpatch v3. This vulnerability allows an unauthenticated, network-based attacker to replace legitimate vSRX images with malicious ones. If a trusted user initiates the deployment, Security Director Policy Enforcer will deliver the attacker's uploaded image to VMware NSX instead of a legitimate one. This issue does not affect Junos Space Security Director Insights.

Impact

Exploitation of this vulnerability could lead to the unauthorized replacement of vSRX images with malicious ones, potentially allowing for the deployment of harmful software or configurations within the VMware NSX environment.