CVEs / CVE-2023-36845

CVE-2023-36845: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

Known exploited in the CISA KEV catalog since 13 Nov 2023
critical 9.8 CVSS 3.1 (from the CNA)
EPSS 95% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 17 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2023-36845

Summary

Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
CISA, Known Exploited Vulnerabilities catalog

Description

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
The CVE record, via NVD · published 17 Aug 2023 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
Juniper Networks Junos OS	before 20.4R3-S9	20.4R3-S9
Juniper Networks Junos OS	from 21.1, before 21.1*	21.1*
Juniper Networks Junos OS	from 21.2, before 21.2R3-S7	21.2R3-S7
Juniper Networks Junos OS	from 21.3, before 21.3R3-S5	21.3R3-S5
Juniper Networks Junos OS	from 21.4, before 21.4R3-S5	21.4R3-S5
Juniper Networks Junos OS	from 22.1, before 22.1R3-S4	22.1R3-S4
Juniper Networks Junos OS	from 22.2, before 22.2R3-S2	22.2R3-S2
Juniper Networks Junos OS	from 22.3, before 22.3R2-S2, 22.3R3-S1	22.3R2-S2, 22.3R3-S1
Juniper Networks Junos OS	from 22.4, before 22.4R2-S1, 22.4R3	22.4R2-S1, 22.4R3
Juniper Networks Junos OS	from 23,2, before 23.2R1-S1, 23.2R2	23.2R1-S1, 23.2R2

Exploitation

In CISA KEV since	13 Nov 2023
Due date for US federal agencies	17 Nov 2023
Used in ransomware campaigns	Unknown
Required action	Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Severity

CVSS 3.1	9.8 critical `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Scored by the CNA ([email protected])
Weakness	CWE-473

References

CVE-2023-36845 on NVD
CVE-2023-36845 in the CISA KEV catalog
https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US (cited by CISA)
http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
https://supportportal.juniper.net/JSA72300 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36845 US Government Resource

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.