Two network perimeter appliance vendors — Juniper and SonicWall — each contributed one confirmed-exploited vulnerability to CISA's Known Exploited Vulnerabilities catalogue, and both describe an attacker gaining administrative control of exactly the device meant to keep unauthorized administrators out. One is a decade-old backdoor-style authentication flaw; the other is a current-generation authorization gap in a management console.
| CVE | CVSS | Component | Originally Disclosed | Added to KEV |
|---|---|---|---|---|
| CVE-2015-7755 | 9.8 | Juniper ScreenOS (SSH/Telnet auth) | 2015 | 2 Oct 2025 |
| CVE-2025-40602 | 6.6 | SonicWall SMA1000 (AMC console) | 2025 | 17 Dec 2025 |
Why perimeter appliances are a uniquely bad place for authentication bugs
Both of these vulnerabilities live in the administrative access path of a device whose entire purpose is enforcing a security boundary — that's a categorically different situation than an authentication bug in an internal line-of-business application, because the appliance itself is the control that's supposed to be trustworthy. CVE-2015-7755 is Juniper's infamous ScreenOS authentication bypass: across a specific range of 6.2.0 and 6.3.0 firmware builds, an unspecified password entered during an SSH or Telnet session grants an attacker administrative access to the device, no legitimate credentials required. This CVE became publicly notorious specifically because it was traced to unauthorized code inserted into ScreenOS's authentication routine — a backdoor, not merely a coding mistake — and the fact that it's still generating confirmed exploitation activity a decade after disclosure and remediation shows how long unpatched firewall and VPN firmware can persist in production, often because upgrading it means a maintenance window and change-control process that gets deferred indefinitely.
CVE-2025-40602 is a much more contemporary and narrower finding: a missing-authorization vulnerability in the SonicWall SMA1000 appliance's management console (AMC) that enables privilege escalation. Unlike the Juniper case, this requires network access with high privileges already (PR:H in its CVSS vector) and high attack complexity (AC:H), landing it at a medium 6.6 rather than the Juniper flaw's critical 9.8 — but it's still a path where a lower-privileged administrative user can escalate beyond their intended authorization boundary on a device managing secure remote access for an entire organization.
What to check this week
Inventory any Juniper ScreenOS devices still in production, however unlikely that seems given the device's age — ScreenOS has been end-of-life for years, but the CVE remaining active in KEV in late 2025 confirms that live, unpatched instances still exist somewhere, and any found should be treated as compromised until proven otherwise given the backdoor's public notoriety.
Review SonicWall SMA1000 AMC access controls and role assignments, since CVE-2025-40602's escalation path depends on existing authenticated access — tightening who holds any administrative-tier credential on the appliance reduces the population of accounts that could exploit this gap.
Treat both findings as management-plane hardening exercises, not just individual patches — verify that administrative interfaces for both device classes are restricted to dedicated management networks rather than reachable from general user or internet-facing segments.
Confirm current firmware versions against each vendor's advisory directly, since perimeter appliances are frequently run past their support window specifically because replacing them requires budget and downtime that get deprioritized relative to more visible application-layer risk.
Why the decade-long gap between Juniper's disclosure and its KEV listing matters
CVE-2015-7755 was disclosed in 2015 and only reached CISA's KEV catalogue a decade later, in October 2025 — a pattern that recurs across this vulnerability series and reflects something specific about perimeter hardware: firewalls and VPN concentrators are provisioned once, placed at a network's edge, and then often left running with minimal interaction for years unless something actively breaks. That operational reality is exactly what makes a decade-old backdoor-style authentication bypass still relevant: the population of organizations that never fully retired their affected ScreenOS hardware is the same population most likely to have deprioritized routine patch review for it.
A closing note on trusting the device that enforces trust
Both vulnerabilities in this cluster undermine the same fundamental assumption — that the appliance controlling access to a network segment is itself resistant to unauthorized access. When that assumption fails, every other control behind the appliance inherits the same failure, because access control that can be bypassed at the perimeter offers no meaningful protection to whatever it was defending.
How Safeguard helps
Safeguard's continuous inventory tracks perimeter and edge infrastructure like firewalls, VPN concentrators, and secure access appliances with the same rigor applied to application-layer software, so that legacy hardware running years past its typical review cycle — exactly where a finding like the decade-old Juniper backdoor tends to hide — doesn't fall outside the visibility an organization has into its own exposure.
