CVE-2023-36845: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-11-13
EPSS: 95.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-17 · updated 2026-06-17
Weakness: CWE-473

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

Summary

CVE-2023-36845 is a critical PHP external variable modification flaw in J-Web of Juniper Junos OS on EX Series and SRX Series devices, allowing an unauthenticated network attacker to set PHPRC and execute code remotely. It affects many releases, including all versions prior to 20.4R3-S9, 21.1R1 and later, and numerous 21.2 through 23.2 versions before their listed fixes. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit, and a 95.1% EPSS probability. Apply the vendor's fixed releases or mitigations immediately, or discontinue use if no mitigation is available.

CVE-2023-36845 ثغرة حرجة في J-Web ضمن Juniper Junos OS على أجهزة EX Series وSRX Series، تسمح لمهاجم غير مصادق عبر الشبكة بتعديل متغير PHP الخارجي PHPRC وتنفيذ تعليمات برمجية عن بُعد. تؤثر في إصدارات متعددة تشمل كل الإصدارات قبل 20.4R3-S9 و21.1R1 وما بعده، وعدة إصدارات من 21.2 إلى 23.2 قبل إصدارات الإصلاح المحددة. الثغرة مدرجة في كتالوج CISA للثغرات المستغلة فعليًا مع استغلال نشط، وثمة استغلال عام متاح واحتمال استغلال 95.1% وفق EPSS. طبّق إصدارات الإصلاح أو التخفيفات من المورّد فورًا، أو أوقف استخدام المنتج إن لم يتوفر تخفيف.

Affected products

Juniper Junos OS: before 20.4; 20.4, 20.4-r1, 20.4-r1-s1, 20.4-r2, 20.4-r2-s1, 20.4-r2-s2 (+86) — fixed in 20.4

How to fix

Upgrade to a fixed version: Juniper Junos OS 20.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36845 or the next vulnerability affects your stack