This vulnerability (CVE-2025-13914) affects Juniper Networks Apstra versions before 6.1.1. It arises from a weakness in the SSH key exchange process where entity authentication is missing, specifically due to insufficient SSH host key validation. An attacker positioned as a man-in-the-middle can impersonate managed devices, intercepting SSH connections and capturing user credentials. The CVSS v3.1 score is 8.7, reflecting high impact on confidentiality and integrity with network attack vector, high attack complexity, no privileges required, and no user interaction. The vulnerability is categorized under CWE-322 (Key Exchange without Entity Authentication). There is no vendor advisory or patch link provided, and the remediation level is unknown.

Successful exploitation allows an unauthenticated attacker to perform a man-in-the-middle attack on SSH connections between Apstra and managed devices. This can lead to impersonation of managed devices and capture of user credentials, compromising confidentiality and integrity of the affected systems. Availability is not impacted. The vulnerability affects all Apstra versions before 6.1.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider limiting network exposure of Apstra management interfaces and SSH connections to trusted networks to reduce the risk of man-in-the-middle attacks. Monitor vendor communications for updates regarding patches or official mitigations.