Recent network monitoring data from SANS reveals a significant spike in targeted scans seeking to exploit default credentials in Juniper Networks’ Session Smart Router (SSR) platform.
Security researchers have observed a massive coordinated campaign attempting to identify and compromise vulnerable devices using factory-set authentication credentials.
Scanning Campaign Details
SANS reported that from March 23rd to March 28th, 2025, approximately 3,000 unique IP addresses were detected scanning for SSR devices using the username “t128” paired with the password “128tRoutes”.
These credentials represent the default factory settings for Juniper’s Session Smart Networking Platform, which many administrators fail to change after deployment.
The scanning activity showed a dramatic surge during this period, with almost no activity before March 23rd and a rapid decline after March 28th, suggesting a highly coordinated campaign.
The graph provided with the original report visually confirms this concentrated scanning pattern, illustrating how the attempts targeting both the username “t128” and password “128tRoutes” rose and fell in near-perfect synchronization, indicating automated attack tooling.
The unusual default credentials stem from Juniper’s 2020 acquisition of 128 Technology for $450 million.
Following the acquisition, Juniper integrated 128 Technology’s session-smart networking capabilities into its product portfolio as the Session Smart Router (SSR) platform but maintained several original configurations, including the default authentication credentials.
According to Juniper’s official documentation, two default accounts are created during SSR installation:
- Username: root | Password: 128tRoutes
- Username: t128 | Password: 128tRoutes
These default credentials are explicitly listed in Juniper’s documentation, making them widely known to both legitimate administrators and potential attackers.
Security experts believe these scans are linked to Mirai botnet operations. In December 2024, Juniper Networks issued a warning that Mirai botnet malware campaigns were targeting SSR products with default passwords.
Once compromised, infected systems are enlisted into botnets, which launch distributed denial-of-service (DDoS) attacks against other targets.
The Mirai malware scans explicitly for known vulnerabilities and default credentials, making unaltered SSR installations prime targets. The malware’s SSH scanner employs a credential dictionary containing common default passwords to facilitate unauthorized access.
The scanning campaign follows Juniper’s February 2025 patching of a critical authentication bypass vulnerability (CVE-2025-21589) affecting the same SSR platform.
This vulnerability allowed attackers to bypass authentication and take administrative control of devices.
While Juniper stated no evidence of exploitation was found at the time, the current scanning campaign may be attempting to identify both unpatched systems and those still using default credentials.
Mitigations
Security experts strongly advise SSR administrators to:
- Immediately change default passwords for both the root and t128 accounts using the documented password change procedures.
- Restrict SSH access from arbitrary internet sources.
- Implement strong, unique passwords rather than predictable patterns.
- Update all SSR installations to the latest patched versions.
- Monitor network logs for unusual SSH login attempts and port scanning activity.
If compromise is suspected, Juniper recommends completely reimaging affected systems, as it’s difficult to determine the full extent of modifications made by attackers.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free
