CVE-2025-13914
Published: 09 April 2026
Summary
CVE-2025-13914 is a high-severity Key Exchange without Entity Authentication (CWE-322) vulnerability in Juniper Networks Apstra (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 12.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-3 (Device Identification and Authentication) and MA-4 (Nonlocal Maintenance).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires unique identification and authentication of managed devices before establishing SSH connections, directly preventing MITM impersonation from insufficient host key validation.
Protects the authenticity of SSH communication sessions, countering attacker impersonation of managed devices during key exchange.
Mandates strong authenticators for nonlocal maintenance sessions like SSH to managed devices, mitigating risks from unauthenticated key exchanges.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables unauthenticated MITM on SSH connections for credential capture due to missing host key validation.
NVD Description
A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to impersonate managed devices. Due to insufficient SSH host key validation an attacker can perform a machine-in-the-middle attack on the…
more
SSH connections from Apstra to managed devices, enabling an attacker to impersonate a managed device and capture user credentials. This issue affects all versions of Apstra before 6.1.1.
Deeper analysisAI
CVE-2025-13914 is a Key Exchange without Entity Authentication vulnerability (CWE-322) in the SSH implementation of Juniper Networks Apstra. The flaw arises from insufficient SSH host key validation, which affects all versions of Apstra prior to 6.1.1. It has a CVSS v3.1 base score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
An unauthenticated man-in-the-middle (MITM) attacker can exploit this vulnerability by intercepting SSH connections from Apstra to managed devices. This allows the attacker to impersonate a managed device and capture user credentials transmitted over those connections.
Juniper advisory JSA107862 provides details on mitigation; upgrading to Apstra version 6.1.1 or later resolves the issue.
Details
- CWE(s)