← Vulnerability feed

Vulnerability record · CVE-2023-36844 · published 17 August 2023

CVE-2023-36844: Juniper Junos OS EX Series J-Web PHP Environment Variable Modification

Juniper · Junos

J-Web on Junos OS for EX Series fails to properly restrict external PHP variable modification, letting an unauthenticated network attacker alter important environment variables via a crafted request. The flaw causes only partial loss of integrity on its own, but Juniper and third parties describe it as chainable with other bugs to reach remote code execution.

5.3 CVSS 3.1 Medium CISA KEV since 13 Nov 2023 EPSS 90% · top 0.2% CWE-473 · CWE-473
5.3CVSS 3.1 base score
90%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
5References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS is only medium (5.3) and impact is partial integrity loss, but the flaw is in CISA KEV with a very high EPSS score and a public exploit reference, and it is designed to be chained toward code execution.

What it is

J-Web on Junos OS for EX Series fails to properly restrict external PHP variable modification, letting an unauthenticated network attacker alter important environment variables via a crafted request. The flaw causes only partial loss of integrity on its own, but Juniper and third parties describe it as chainable with other bugs to reach remote code execution.

Impact

An attacker can influence PHP environment state on the exposed J-Web interface, which by itself yields limited integrity impact but can be combined with other flaws to achieve code execution on the device.

Attack surface

Reachable over the network through the J-Web HTTP interface on EX Series devices; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N).

Exploitation

It is listed in CISA KEV with a November 2023 remediation deadline, EPSS is very high (0.89958, 99.8th percentile), and a public Packet Storm exploit reference exists, indicating active exploitation.

What to do

  • Upgrade Junos OS on EX Series to a fixed release per Juniper JSA72300 (for example 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R3-S1, 22.4R2-S2/22.4R3, 23.2R1-S1/23.2R2 or later).
  • If patching is not immediately possible, disable or restrict J-Web access as directed by Juniper, or discontinue use of the affected interface.
  • Block untrusted network access to J-Web management interfaces using firewall rules or management VLANs.
  • Apply the mitigations in Juniper JSA72300 and CISA's required action for KEV entries.
  • Monitor for and apply any subsequent Juniper advisories, since this flaw is intended to be chained with others.

Detection

  • Inspect J-Web HTTP request logs for crafted requests that set or modify PHP environment variables.
  • Alert on unexpected or anomalous requests to J-Web endpoints from untrusted source addresses.
  • Correlate J-Web access with subsequent exploitation attempts or code execution indicators on EX Series devices.
  • Track Junos OS version inventory against the fixed releases listed in JSA72300.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-36844 to the Known Exploited Vulnerabilities catalog on 13 November 2023 as "Juniper Junos OS EX Series PHP External Variable Modification Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 November 2023.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://supportportal.juniper.net/JSA72300 Vendor Advisory
http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://supportportal.juniper.net/JSA72300 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36844 US Government Resource

Track CVE-2023-36844 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-36845Juniper Junos OS J-Web PHP variable modification RCEJ-Web in Junos OS on EX Series and SRX Series mishandles the PHP PHPRC environment variable, letting a crafted request alter the PHP execution enviro…KEVEPSS 95%analysed9.8CVE-2020-1631Juniper Junos OS J-Web HTTP service path traversal and local file inclusionThe HTTP/HTTPS service behind J-Web, Web Authentication, Dynamic-VPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP in Junos OS doe…KEVEPSS 4.8%analysed6.7CVE-2025-21590Juniper Junos OS kernel improper isolation allows local code injectionJunos OS contains an improper isolation or compartmentalization flaw in the kernel that lets a local attacker with shell access inject arbitrary code…KEVEPSS 1.7%analysed5.3CVE-2023-36851Juniper Junos OS SRX J-Web missing authentication allows file upload/downloadJunos OS on SRX Series exposes webauth_operation.php without authentication, letting a network attacker upload and download arbitrary files through J…KEVEPSS 1.1%analysed5.3CVE-2023-36846Juniper Junos OS SRX J-Web Missing Authentication Allows File UploadJunos OS on SRX Series fails to require authentication for a critical function in user.php reachable through J-Web, letting an unauthenticated networ…KEVEPSS 93%analysed5.3CVE-2023-36847Juniper Junos OS EX Series J-Web installAppPackage.php missing authenticationJunos OS on EX Series exposes installAppPackage.php through J-Web without requiring authentication. An unauthenticated network attacker can upload ar…KEVEPSS 83%analysed10.0CVE-2021-31384Juniper junos improper authorization vulnerabilityDue to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in …EPSS 1.2%10.0CVE-2021-0248Juniper junos hard-coded credentials vulnerabilityThis issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an …EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2023-36844), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.