CVE-2023-36846: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: yes — in CISA KEV since 2023-11-13
EPSS: 93.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-17 · updated 2026-06-17
Weakness: CWE-306

Description

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S3; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3; * 22.4 versions prior to 22.4R2-S1, 22.4R3.

Summary

CVE-2023-36846 is a missing authentication flaw in Juniper Junos OS on SRX Series devices, where a specific unauthenticated request to user.php via J-Web allows a network-based attacker to upload arbitrary files, compromising file system integrity and potentially enabling chaining to other vulnerabilities. It affects all versions prior to 20.4R3-S8, 21.1R1 and later, and numerous 21.2 through 22.4 releases before their listed fixed versions. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 93.5% probability of exploitation in 30 days. Apply the vendor's fixed releases (such as 20.4R3-S8 and the listed 21.x/22.x maintenance versions) or follow Juniper's mitigations, and discontinue use if no mitigation is available.

CVE-2023-36846 هو ثغرة انعدام مصادقة لوظيفة حرجة في Juniper Junos OS على أجهزة SRX Series، إذ يسمح طلب محدد غير موثّق إلى user.php عبر J-Web للمهاجم عبر الشبكة برفع ملفات عشوائية، ما يضر بسلامة نظام الملفات وقد يتيح تسلسل الثغرات. تؤثر في جميع الإصدارات الأقدم من 20.4R3-S8، وفي 21.1R1 وما بعده، وفي إصدارات 21.2 حتى 22.4 الأقدم من الإصدارات المُصلحة المذكورة. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 93.5%. طبّق الإصدارات المُصلحة من المورّد (مثل 20.4R3-S8 وإصدارات الصيانة المذكورة في 21.x و22.x) أو اتبع تخفيفات Juniper، وتوقف عن استخدام المنتج إن لم تتوفر معالجة.

Affected products

Juniper Junos OS: before 20.4; 20.4, 20.4-r1, 20.4-r1-s1, 20.4-r2, 20.4-r2-s1, 20.4-r2-s2 (+82) — fixed in 20.4

How to fix

Upgrade to a fixed version: Juniper Junos OS 20.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36846 or the next vulnerability affects your stack