{"id":"CVE-2023-36845","kind":"vulnerability","aliases":["CVE-2023-36845"],"related":[],"title":"juniper junos: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series…","description":"A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series \n\nand SRX Series \n\nallows an unauthenticated, network-based attacker to remotely execute code.\n\nUsing a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.\n\n\nThis issue affects Juniper Networks Junos OS on EX Series\n\n\nand \n\n\nSRX Series:\n\n\n\n  *  All versions prior to \n\n20.4R3-S9;\n  *  21.1 versions 21.1R1 and later;\n  *  21.2 versions prior to 21.2R3-S7;\n  *  21.3 versions prior to 21.3R3-S5;\n  *  21.4 versions prior to 21.4R3-S5;\n  *  22.1 versions \n\nprior to \n\n22.1R3-S4;\n  *  22.2 versions \n\nprior to \n\n22.2R3-S2;\n  *  22.3 versions \n\nprior to \n\n22.3R2-S2, 22.3R3-S1;\n  *  22.4 versions \n\nprior to \n\n22.4R2-S1, 22.4R3;\n  *  23.2 versions prior to 23.2R1-S1, 23.2R2.","summary":"J-Web on Junos OS EX and SRX lets an unauthenticated network attacker set PHPRC with a crafted request and run code (CVSS 9.8). Only devices with J-Web enabled (system services web-management http or https) are exposed. Juniper confirmed exploitation in the wild on 2023-11-08, and a one-request public PoC exists.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-11-13T00:00:00+00:00","products":[{"name":"Juniper Junos OS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Junos OS (EX Series, SRX Series)","fixed":["20.4R3-S9","21.2R3-S7","21.3R3-S5","21.4R3-S5","22.1R3-S4","22.2R3-S2","22.3R2-S2","22.3R3-S1","22.4R2-S1","22.4R3","23.2R1-S1","23.2R2","23.4R1"],"affected":"< 20.4R3-S9; 21.1 all; 21.2 < 21.2R3-S7; 21.3 < 21.3R3-S5; 21.4 < 21.4R3-S5; 22.1 < 22.1R3-S4; 22.2 < 22.2R3-S2; 22.3 < 22.3R2-S2, 22.3R3-S1; 22.4 < 22.4R2-S1, 22.4R3; 23.2 < 23.2R1-S1, 23.2R2","ecosystem":"vendor"},{"name":"juniper junos","fixed":["20.4"],"affected":"< 20.4","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 20.4","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 21.1","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 21.2","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 21.3","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 21.4","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 22.1","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 22.2","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 22.3","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 22.4","ecosystem":"vendor"},{"name":"juniper junos","fixed":[],"affected":"= 23.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ex-series","exploited","infrastructure","j-web","juniper","junos","network-appliance","poc-public","srx-series"],"not_affected_if":["fixed-junos-release","j-web-disabled","j-web-restricted-to-trusted-hosts","non-ex-series-and-non-srx-hardware"],"how_to_check":"Run 'show configuration system services web-management' on the device. If http or https is configured, J-Web is enabled and the device is exposed. Then run 'show version' and compare to the fixed releases. Affected is anything below the fixed release in your train: all before 20.4R3-S9, 21.1 (EoE, no fix), 21.2 before 21.2R3-S7, 21.3 before 21.3R3-S5, 21.4 before 21.4R3-S5, 22.1 before 22.1R3-S4, 22.2 before 22.2R3-S2, 22.3 before 22.3R2-S2 or 22.3R3-S1, 22.4 before 22.4R2-S1 or 22.4R3, 23.2 before 23.2R1-S1 or 23.2R2.","fix":"Upgrade to 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R2-S1, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1 or later. Workaround: disable J-Web (delete system services web-management http/https) or limit access to trusted hosts. 21.1 is end of engineering with no fix, so move to a fixed train.","status":"open","published_at":"2023-08-17T20:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:54+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T21:02:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or fixed Junos OS release from Juniper's advisory for CVE-2023-36845; if no mitigation exists, stop using the affected device per CISA's required action.","reach":"network","impact":"high","summary":"Juniper Junos OS on EX Series and SRX Series switches and firewalls has a PHP external variable flaw: an unauthenticated network attacker sends a crafted request that sets the PHPRC variable and gets code injected and run. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["juniper","junos","ex-series","srx-series","network-appliance"],"confidence":0.8,"needs_auth":"no","worst_case":"unauthenticated attacker runs injected code on the network device","analyst_note":"Find the affected and fixed Junos OS versions and the mitigation text in Juniper's security advisory (JSA) for CVE-2023-36845 and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-ex-series-and-non-srx-hardware","fixed-junos-release"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000501,"input_tokens":2885,"output_tokens":426,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed Junos OS versions and the mitigation text in Juniper's security advisory (JSA) for CVE-2023-36845 and the CISA KEV entry.","search":"'-08':131B '-11':130B '-2023':25A,28A '-36845':26A,29A '20.4':215C '2023':129B '21.1':219C,221C '21.2':225C,229C '21.3':233C,237C '21.4':241C,245C '22.1':249C,253C '22.2':257C,261C '22.3':265C,269C,273C '22.4':277C,281C,285C '23.2':287C,291C,295C '9.8':104B 'abl':184C 'affect':200C 'allow':161C,191C 'applianc':73B 'attack':93B,167C,182C 'base':166C 'code':102B,171C,197C 'confirm':123B 'craft':98B,174C 'cve':24A,27A 'cvss':103B 'devic':106B 'enabl':111B 'environ':190C 'ex':19A,35A,62B,86B,156C,206C 'ex-seri':61B 'execut':170C,189C,195C 'exist':139B 'exploit':64B,124B 'expos':121B 'extern':5A,142C 'http':117B 'https':119B 'infrastructur':65B 'inject':193C 'issu':199C 'j':11A,67B,81B,109B,148C 'j-web':10A,66B,80B,108B,147C 'junip':1A,14A,69B,122B,151C,201C 'juniper':30A,39A,41A,43A,45A,47A,49A,51A,53A,55A,57A,59A 'juno':2A,16A,70B,84B,153C,203C 'junos':31A,33A,40A,42A,44A,46A,48A,50A,52A,54A,56A,58A,60A 'later':224C 'let':89B 'manag':116B 'modif':7A,144C 'modifi':186C 'network':15A,72B,92B,152C,165C,202C 'network-appli':71B 'network-bas':164C 'one':135B 'one-request':134B 'os':17A,32A,34A,85B,154C,204C 'php':4A,141C,188C 'phprc':95B,180C 'poc':75B,138B 'poc-publ':74B 'prior':213C,227C,235C,243C,251C,259C,267C,279C,289C 'public':76B,137B 'r1':222C,293C 'r1-s1':292C 'r2':271C,283C,296C 'r2-s1':282C 'r2-s2':270C 'r3':217C,231C,239C,247C,255C,263C,275C,286C 'r3-s1':274C 'r3-s2':262C 'r3-s4':254C 'r3-s5':238C,246C 'r3-s7':230C 'r3-s9':216C 'remot':169C 'request':99B,136B,175C 'run':101B 's1':276C,284C,294C 's2':264C,272C 's4':256C 's5':240C,248C 's7':232C 's9':218C 'seri':20A,23A,63B,79B,157C,160C,207C,210C 'series':36A,38A 'servic':113B 'set':94B,177C 'srx':22A,37A,78B,88B,159C,209C 'srx-seri':77B 'system':112B 'unauthent':91B,163C 'und':194C 'use':172C 'variabl':6A,143C,179C 'version':212C,220C,226C,234C,242C,250C,258C,266C,278C,288C 'vulner':8A,145C 'web':12A,68B,82B,110B,115B,149C 'web-manag':114B 'wild':127B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-08-17T20:15:10+00:00","kev":{"dateAdded":"2023-11-13","dueDate":"2023-11-17","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"sirt@juniper.net","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2023-36845","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845","severity":null,"published_at":"2023-11-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2023-36845:37","url":null,"severity":null,"published_at":"2026-10-23T21:04:18+00:00","modified_at":"2026-10-23T21:04:18+00:00","first_seen_at":"2026-10-23T21:04:18+00:00","fetched_at":"2026-10-23T21:04:18+00:00","note":"Read Juniper JSA72300 (primary): J-Web PHPRC flaw on EX/SRX, fixed in listed releases; Juniper confirms exploitation (2023-11-08); CERT-EU notes a public single-curl PoC (2023-09-18). Did not open the CISA KEV page itself."},{"source":"nvd","external_id":"CVE-2023-36845","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36845","severity":null,"published_at":"2023-08-17T20:15:10+00:00","modified_at":"2026-06-17T06:07:12+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[{"id":904,"url":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution","title":"JSA72300 Juniper out-of-cycle bulletin: J-Web preAuth RCE chain","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":904,"url":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution","title":"JSA72300 Juniper out-of-cycle bulletin: J-Web preAuth RCE chain","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":904,"url":"https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution","title":"JSA72300 Juniper out-of-cycle bulletin: J-Web preAuth RCE chain","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":905,"url":"https://cert.europa.eu/publications/security-advisories/2023-059/","title":"CERT-EU 2023-059: Multiple Junos OS vulnerabilities (PoC notes)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}