This vulnerability (CVE-2025-13914) affects Juniper Networks Apstra versions before 6.1.1. It arises from a weakness in the SSH key exchange process where entity authentication is missing, classified under CWE-322. Due to inadequate validation of SSH host keys, an attacker positioned as a man-in-the-middle can impersonate managed devices, intercept SSH sessions, and capture user credentials. The CVSS 3.1 base score is 8.7, reflecting high impact on confidentiality and integrity with network attack vector, high attack complexity, no privileges required, and no user interaction.

An attacker exploiting this vulnerability can impersonate managed devices in SSH connections, enabling credential capture and potentially unauthorized access or manipulation of network management operations. The confidentiality and integrity of communications between Apstra and managed devices are severely impacted. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects all Apstra versions before 6.1.1, so upgrading to version 6.1.1 or later is likely required once a fix is released. Until an official fix is available, organizations should consider additional SSH security controls such as strict host key verification policies and network-level protections to reduce exposure.