CVE-2025-6549: SRX Series: J-Web can be exposed on additional interfaces

Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.

Affected and fixed versions

Product / branch	Fixed in
Junos OS (SRX Series) 0	21.4R3-S9 or later
Junos OS (SRX Series) 22.2	22.2R3-S5 or later
Junos OS (SRX Series) 22.4	22.4R3-S5 or later
Junos OS (SRX Series) 23.2	23.2R2-S3 or later
Junos OS (SRX Series) 23.4	23.4R2-S5 or later
Junos OS (SRX Series) 24.2	24.2R2 or later

Always confirm against the vendor advisory, which lists every fixed hotfix.

What it is

An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the

Juniper Web Device Manager

(J-Web).

When Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS:

all versions before 21.4R3-S9,
22.2 versions before 22.2R3-S5,
22.4 versions before 22.4R3-S5,
23.2 versions before 23.2R2-S3,
23.4 versions before 23.4R2-S5,
24.2 versions before 24.2R2.

Am I affected?

A system is affected if more than one interface is specified for J-Web:

[ system services web-management http(s) <interface> ]

or JSC is configured:

[ security ike gateway <ik-gw-name> external-interface <interface> ]

Workarounds

To reduce the risk of exploitation configure a firewall filter on all ingress interfaces over which J-Web is not meant to be reachable or ensure that the resp. security policies don't allow such connections.

Exploitation

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.