Live › vulnerability › CVE-2023-36851
Go to dashboardJuniper Junos OS on SRX firewalls has a J-Web endpoint (webauth_operation.php) that accepts requests without authentication. An unauthenticated network attacker can upload arbitrary files to the device, which compromises file system integrity and may be chained into further attacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Juniper Junos OS | vendor | – | – |
| juniper junos | vendor | = 21.2 | – |
| juniper junos | vendor | = 21.4 | – |
| juniper junos | vendor | = 22.1 | – |
| juniper junos | vendor | = 22.2 | – |
| juniper junos | vendor | = 22.3 | – |
| juniper junos | vendor | = 22.4 | – |
| juniper junos | vendor | = 23.2 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to
webauth_operation.php
that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of
integrity or confidentiality, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
21.2 versions prior to 21.2R3-S8;
versions prior to
21.4R3-S6;
versions prior to
22.1R3-S5;
versions prior to
22.2R3-S3;
versions prior to
22.3R3-S2;
23.2R1-S2, 23.2R2.
This page as .md · .json · in your agent: get_signal("CVE-2023-36851")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.