--- id: "CVE-2023-36845" kind: "vulnerability" aliases: ["CVE-2023-36845"] title: "juniper junos: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Juniper Junos OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Junos OS (EX Series, SRX Series)", "fixed": ["20.4R3-S9", "21.2R3-S7", "21.3R3-S5", "21.4R3-S5", "22.1R3-S4", "22.2R3-S2", "22.3R2-S2", "22.3R3-S1", "22.4R2-S1", "22.4R3", "23.2R1-S1", "23.2R2", "23.4R1"], "affected": "< 20.4R3-S9; 21.1 all; 21.2 < 21.2R3-S7; 21.3 < 21.3R3-S5; 21.4 < 21.4R3-S5; 22.1 < 22.1R3-S4; 22.2 < 22.2R3-S2; 22.3 < 22.3R2-S2, 22.3R3-S1; 22.4 < 22.4R2-S1, 22.4R3; 23.2 < 23.2R1-S1, 23.2R2", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": ["20.4"], "affected": "< 20.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 20.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.1", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.2", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.3", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 21.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.1", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.2", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.3", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 22.4", "ecosystem": "vendor"}, {"name": "juniper junos", "fixed": [], "affected": "= 23.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["ex-series", "exploited", "infrastructure", "j-web", "juniper", "junos", "network-appliance", "poc-public", "srx-series"] not_affected_if: ["fixed-junos-release", "j-web-disabled", "j-web-restricted-to-trusted-hosts", "non-ex-series-and-non-srx-hardware"] published_at: "2023-08-17T20:15:10+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:04:18+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36845", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # juniper junos: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series… J-Web on Junos OS EX and SRX lets an unauthenticated network attacker set PHPRC with a crafted request and run code (CVSS 9.8). Only devices with J-Web enabled (system services web-management http or https) are exposed. Juniper confirmed exploitation in the wild on 2023-11-08, and a one-request public PoC exists. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Juniper Junos OS affected ? fixed ? - vendor:Junos OS (EX Series, SRX Series) affected < 20.4R3-S9; 21.1 all; 21.2 < 21.2R3-S7; 21.3 < 21.3R3-S5; 21.4 < 21.4R3-S5; 22.1 < 22.1R3-S4; 22.2 < 22.2R3-S2; 22.3 < 22.3R2-S2, 22.3R3-S1; 22.4 < 22.4R2-S1, 22.4R3; 23.2 < 23.2R1-S1, 23.2R2 fixed 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R2-S1, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1 - vendor:juniper junos affected < 20.4 fixed 20.4 - vendor:juniper junos affected = 20.4 fixed ? - vendor:juniper junos affected = 21.1 fixed ? - vendor:juniper junos affected = 21.2 fixed ? - vendor:juniper junos affected = 21.3 fixed ? - vendor:juniper junos affected = 21.4 fixed ? - vendor:juniper junos affected = 22.1 fixed ? - vendor:juniper junos affected = 22.2 fixed ? - vendor:juniper junos affected = 22.3 fixed ? - vendor:juniper junos affected = 22.4 fixed ? - vendor:juniper junos affected = 23.2 fixed ? ## How to check Run 'show configuration system services web-management' on the device. If http or https is configured, J-Web is enabled and the device is exposed. Then run 'show version' and compare to the fixed releases. Affected is anything below the fixed release in your train: all before 20.4R3-S9, 21.1 (EoE, no fix), 21.2 before 21.2R3-S7, 21.3 before 21.3R3-S5, 21.4 before 21.4R3-S5, 22.1 before 22.1R3-S4, 22.2 before 22.2R3-S2, 22.3 before 22.3R2-S2 or 22.3R3-S1, 22.4 before 22.4R2-S1 or 22.4R3, 23.2 before 23.2R1-S1 or 23.2R2. ## Fix Upgrade to 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R2-S1, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1 or later. Workaround: disable J-Web (delete system services web-management http/https) or limit access to trusted hosts. 21.1 is end of engineering with no fix, so move to a fixed train. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-36845 - 2026-10-23T21:04:18+00:00 analyst — Read Juniper JSA72300 (primary): J-Web PHPRC flaw on EX/SRX, fixed in listed releases; Juniper confirms exploitation (2023-11-08); CERT-EU notes a public single-curl PoC (2023-09-18). Did not open the CISA KEV page itself. - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-36845 ## Documents - [advisory] JSA72300 Juniper out-of-cycle bulletin: J-Web preAuth RCE chain https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution - [fix] JSA72300 Juniper out-of-cycle bulletin: J-Web preAuth RCE chain https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution - [mitigation] JSA72300 Juniper out-of-cycle bulletin: J-Web preAuth RCE chain https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution - [poc] CERT-EU 2023-059: Multiple Junos OS vulnerabilities (PoC notes) https://cert.europa.eu/publications/security-advisories/2023-059/ ## From the sources A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_