PT-2023-4587 · Juniper Networks · Junos

Published 2023-08-17 · Updated 2025-10-24 · CVE-2023-36845

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 20.4R3-S9 Juniper Networks Junos OS version 21.1R1 and later Juniper Networks Junos OS versions prior to 21.2R3-S7 Juniper Networks Junos OS versions prior to 21.3R3-S5 Juniper Networks Junos OS versions prior to 21.4R3-S5 Juniper Networks Junos OS versions prior to 22.1R3-S4 Juniper Networks Junos OS versions prior to 22.2R3-S2 Juniper Networks Junos OS versions prior to 22.3R2-S2, 22.3R3-S1 Juniper Networks Junos OS versions prior to 22.4R2-S1, 22.4R3 Juniper Networks Junos OS versions prior to 23.2R1-S1, 23.2R2

Description A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Utilizing a crafted request, an attacker is able to modify a certain PHP environment variable, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series. The estimated number of potentially affected devices worldwide is around 12,000 Juniper SRX firewalls and EX switches.

Recommendations For versions prior to 20.4R3-S9, update to version 20.4R3-S9 or later. For version 21.1R1 and later, update to a version that is not prior to 21.2R3-S7. For versions prior to 21.2R3-S7, update to version 21.2R3-S7 or later. For versions prior to 21.3R3-S5, update to version 21.3R3-S5 or later. For versions prior to 21.4R3-S5, update to version 21.4R3-S5 or later. For versions prior to 22.1R3-S4, update to version 22.1R3-S4 or later. For versions prior to 22.2R3-S2, update to version 22.2R3-S2 or later. For versions prior to 22.3R2-S2, 22.3R3-S1, update to version 22.3R2-S2, 22.3R3-S1 or later. For versions prior to 22.4R2-S1, 22.4R3, update to version 22.4R2-S1, 22.4R3 or later. For versions prior to 23.2R1-S1, 23.2R2, update to version 23.2R1-S1, 23.2R2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-473

Related Identifiers

BDU:2023-04994

CVE-2023-36845

Affected Products

Junos

References · 154

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb · Exploit
• 🔥 https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844 · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2023-36845 · Exploit
• 🔥 https://github.com/vulncheck-oss/cve-2023-36845-scanner · Exploit
• 🔥 https://github.com/Asbawy/Automation-for-Juniper-cve-2023-36845 · Exploit
• 🔥 https://github.com/zaenhaxor/CVE-2023-36845 · Exploit
• 🔥 https://github.com/ak1t4/CVE-2023-36845 · Exploit
• 🔥 http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36845 · Security Note
• https://bdu.fstec.ru/vul/2023-04994 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36845 · Vendor Advisory
• https://supportportal.juniper.net/JSA72300 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/698973 · Security Note
• https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US · Security Note