← Vulnerability feed

Vulnerability record · CVE-2023-36845 · published 17 August 2023

CVE-2023-36845: Juniper Junos OS J-Web PHP variable modification RCE

Juniper · Junos

J-Web in Junos OS on EX Series and SRX Series mishandles the PHP PHPRC environment variable, letting a crafted request alter the PHP execution environment. This permits unauthenticated, network-based remote code execution on the affected device. Because J-Web is commonly internet-exposed on these edge devices, the flaw is severe.

9.8 CVSS 3.1 Critical CISA KEV since 13 Nov 2023 EPSS 95% · top 0.1% CWE-473 · CWE-473
9.8CVSS 3.1 base score
95%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
7References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with CVSS 9.8, KEV listing and very high EPSS on widely deployed edge devices.

What it is

J-Web in Junos OS on EX Series and SRX Series mishandles the PHP PHPRC environment variable, letting a crafted request alter the PHP execution environment. This permits unauthenticated, network-based remote code execution on the affected device. Because J-Web is commonly internet-exposed on these edge devices, the flaw is severe.

Impact

An attacker can execute arbitrary code on the device, gaining control of the firewall or switch and potentially pivoting into the internal network.

Attack surface

Reachable over the network via the J-Web interface with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Listed in CISA KEV with a due date of 2023-11-17, and EPSS 30-day probability is about 0.95 (99.8th percentile); public exploit references are tagged Exploit.

What to do

  • Upgrade Junos OS to a fixed release per Juniper advisory JSA72300 (for example 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2/22.3R3-S1, 22.4R2-S1/22.4R3, 23.2R1-S1/23.2R2 or later).
  • If patching is not immediately possible, disable J-Web or restrict access to it from untrusted networks.
  • Apply vendor-provided mitigations or discontinue use of the product if mitigations are unavailable, as directed by CISA KEV.
  • Segment management interfaces so J-Web is not reachable from the internet.

Detection

  • Monitor J-Web access logs for requests that set or manipulate the PHPRC parameter.
  • Alert on unexpected child processes or shell activity spawned by the J-Web/PHP service.
  • Watch for anomalous outbound connections from EX/SRX management interfaces.
  • Review for unexpected file writes or configuration changes on affected devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-36845 to the Known Exploited Vulnerabilities catalog on 13 November 2023 as "Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 November 2023.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://supportportal.juniper.net/JSA72300 Vendor Advisory
http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
https://supportportal.juniper.net/JSA72300 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36845 US Government Resource

Track CVE-2023-36845 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-1631Juniper Junos OS J-Web HTTP service path traversal and local file inclusionThe HTTP/HTTPS service behind J-Web, Web Authentication, Dynamic-VPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP in Junos OS doe…KEVEPSS 4.8%analysed6.7CVE-2025-21590Juniper Junos OS kernel improper isolation allows local code injectionJunos OS contains an improper isolation or compartmentalization flaw in the kernel that lets a local attacker with shell access inject arbitrary code…KEVEPSS 1.7%analysed5.3CVE-2023-36851Juniper Junos OS SRX J-Web missing authentication allows file upload/downloadJunos OS on SRX Series exposes webauth_operation.php without authentication, letting a network attacker upload and download arbitrary files through J…KEVEPSS 1.1%analysed5.3CVE-2023-36844Juniper Junos OS EX Series J-Web PHP Environment Variable ModificationJ-Web on Junos OS for EX Series fails to properly restrict external PHP variable modification, letting an unauthenticated network attacker alter impo…KEVEPSS 90%analysed5.3CVE-2023-36846Juniper Junos OS SRX J-Web Missing Authentication Allows File UploadJunos OS on SRX Series fails to require authentication for a critical function in user.php reachable through J-Web, letting an unauthenticated networ…KEVEPSS 93%analysed5.3CVE-2023-36847Juniper Junos OS EX Series J-Web installAppPackage.php missing authenticationJunos OS on EX Series exposes installAppPackage.php through J-Web without requiring authentication. An unauthenticated network attacker can upload ar…KEVEPSS 83%analysed10.0CVE-2021-31384Juniper junos improper authorization vulnerabilityDue to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in …EPSS 1.2%10.0CVE-2021-0248Juniper junos hard-coded credentials vulnerabilityThis issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an …EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2023-36845), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.