← Vulnerability feed

Vulnerability record · CVE-2023-36847 · published 17 August 2023

CVE-2023-36847: Juniper Junos OS EX Series J-Web installAppPackage.php missing authentication

Juniper · Junos

Junos OS on EX Series exposes installAppPackage.php through J-Web without requiring authentication. An unauthenticated network attacker can upload arbitrary files, causing loss of integrity in part of the file system. The flaw matters because it can be chained with other vulnerabilities to expand impact.

5.3 CVSS 3.1 Medium CISA KEV since 13 Nov 2023 EPSS 83% · top 0.3% CWE-306 · Missing authentication for critical function
5.3CVSS 3.1 base score
83%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S4; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S1; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-term remediation deadline and a very high EPSS score, and it is an unauthenticated network-reachable flaw on edge network devices.

What it is

Junos OS on EX Series exposes installAppPackage.php through J-Web without requiring authentication. An unauthenticated network attacker can upload arbitrary files, causing loss of integrity in part of the file system. The flaw matters because it can be chained with other vulnerabilities to expand impact.

Impact

An attacker gains the ability to write arbitrary files to a portion of the device file system without credentials. This integrity loss can serve as a stepping stone for further compromise through chained flaws.

Attack surface

Reachable over the network via J-Web on EX Series devices; the CVSS vector shows no privileges required and no user interaction. Any internet- or network-exposed J-Web interface is a candidate entry point.

Exploitation

CISA added it to KEV on 2023-11-13 with a 2023-11-17 remediation due date, and EPSS is 0.85769 (99.7th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented.

What to do

  • Upgrade Junos OS on EX Series to a fixed release: 20.4R3-S8 or later, 21.2R3-S6 or later, 21.3R3-S5 or later, 21.4R3-S4 or later, 22.1R3-S3 or later, 22.2R3-S1 or later, 22.3R2-S2/22.3R3 or later, or 22.4R2-S1/22.4R3 or later.
  • If immediate patching is not possible, disable or restrict J-Web access per Juniper's vendor guidance.
  • Block untrusted network access to J-Web management interfaces using firewall rules or management VLANs.
  • Monitor for and remove unexpected files uploaded to the device file system.
  • Track the CISA KEV remediation deadline and confirm patched status.

Detection

  • Inspect J-Web and web server logs for POST requests to installAppPackage.php, especially from unauthenticated or unexpected sources.
  • Alert on file creation or modification events in file system areas writable by J-Web.
  • Monitor for anomalous outbound or lateral activity from EX Series devices that could indicate chaining after file upload.
  • Audit J-Web exposure to confirm management interfaces are not reachable from untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2023-36847 to the Known Exploited Vulnerabilities catalog on 13 November 2023 as "Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 November 2023.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://supportportal.juniper.net/JSA72300 Vendor Advisory
https://supportportal.juniper.net/JSA72300 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36847 US Government Resource

Track CVE-2023-36847 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-36845Juniper Junos OS J-Web PHP variable modification RCEJ-Web in Junos OS on EX Series and SRX Series mishandles the PHP PHPRC environment variable, letting a crafted request alter the PHP execution enviro…KEVEPSS 95%analysed9.8CVE-2020-1631Juniper Junos OS J-Web HTTP service path traversal and local file inclusionThe HTTP/HTTPS service behind J-Web, Web Authentication, Dynamic-VPN, Firewall Authentication Pass-Through with Web-Redirect, and ZTP in Junos OS doe…KEVEPSS 4.8%analysed6.7CVE-2025-21590Juniper Junos OS kernel improper isolation allows local code injectionJunos OS contains an improper isolation or compartmentalization flaw in the kernel that lets a local attacker with shell access inject arbitrary code…KEVEPSS 1.7%analysed5.3CVE-2023-36851Juniper Junos OS SRX J-Web missing authentication allows file upload/downloadJunos OS on SRX Series exposes webauth_operation.php without authentication, letting a network attacker upload and download arbitrary files through J…KEVEPSS 1.1%analysed5.3CVE-2023-36844Juniper Junos OS EX Series J-Web PHP Environment Variable ModificationJ-Web on Junos OS for EX Series fails to properly restrict external PHP variable modification, letting an unauthenticated network attacker alter impo…KEVEPSS 90%analysed5.3CVE-2023-36846Juniper Junos OS SRX J-Web Missing Authentication Allows File UploadJunos OS on SRX Series fails to require authentication for a critical function in user.php reachable through J-Web, letting an unauthenticated networ…KEVEPSS 93%analysed10.0CVE-2021-31384Juniper junos improper authorization vulnerabilityDue to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in …EPSS 1.2%10.0CVE-2021-0248Juniper junos hard-coded credentials vulnerabilityThis issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an …EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2023-36847), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.