CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
- All versions prior to
20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions prior to 21.3R3-S5;
- 21.4 versions prior to 21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S1, 22.4R3;
- 23.2 versions prior to 23.2R1-S1, 23.2R2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
- All versions prior to
20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions prior to 21.3R3-S5;
- 21.4 versions prior to 21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S1, 22.4R3;
- 23.2 versions prior to 23.2R1-S1, 23.2R2.
- Record
CVE-2023-36845- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-473
- Updated
- 2026-11-02
EUVDEUVD-2023-40765
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
- All versions prior to
20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions prior to 21.3R3-S5;
- 21.4 versions prior to 21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S1, 22.4R3;
- 23.2 versions prior to 23.2R1-S1, 23.2R2.
- Record
EUVD-2023-40765- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q56g-qr28-qh57
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX...
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to control certain, important environments variables.
Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
- All versions prior to 21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S1, 22.4R3;
- 23.2 versions prior to 23.2R1-S1, 23.2R2.
- Record
GHSA-q56g-qr28-qh57- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-473
- Updated
- 2026-11-02
CISA KEV No score
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
- Record
CVE-2023-36845- Weakness
- CWE-473
- Updated
- 2026-11-02
NVD
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
- All versions prior to
20.4R3-S9;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S7;
- 21.3 versions prior to 21.3R3-S5;
- 21.4 versions prior to 21.4R3-S5;
- 22.1 versions
prior to
22.1R3-S4;
- 22.2 versions
prior to
22.2R3-S2;
- 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
- 22.4 versions
prior to
22.4R2-S1, 22.4R3;
- 23.2 versions prior to 23.2R1-S1, 23.2R2.
- Record
CVE-2023-36845- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-473
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Junos OS PHPRC Environment Variable Manipulation RCE | 2023-08-17 |
| PoC in GitHub | vulncheck-oss/cve-2023-36845-scanner | 2023-09-16 |
| PoC in GitHub | kljunowsky/CVE-2023-36845 | 2023-09-26 |
| PoC in GitHub | halencarjunior/CVE-2023-36845 | 2023-09-27 |
| PoC in GitHub | zaenhaxor/CVE-2023-36845 | 2023-09-29 |
| PoC in GitHub | simrotion13/CVE-2023-36845 | 2023-10-01 |
| PoC in GitHub | cyberh3als/CVE-2023-36845-POC | 2023-10-02 |
| PoC in GitHub | P4x1s/ansible-cve-2023-36845 | 2023-11-15 |
| PoC in GitHub | Asbawy/Automation-for-Juniper-cve-2023-36845 | 2024-01-29 |
| PoC in GitHub | jahithoque/Juniper-CVE-2023-36845-Mass-Hunting | 2024-01-30 |
Show 9 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | cyb3rzest/Juniper-Bug-Automation-CVE-2023-36845 | 2024-02-01 |
| PoC in GitHub | CharonDefalt/Juniper-exploit-CVE-2023-36845 | 2024-02-03 |
| PoC in GitHub | ak1t4/CVE-2023-36845 | 2024-02-13 |
| PoC in GitHub | iveresk/CVE-2023-36845-6- | 2024-02-13 |
| PoC in GitHub | 0xNehru/CVE-2023-36845-Juniper-Vulnerability | 2024-02-14 |
| PoC in GitHub | ifconfig-me/CVE-2023-36845 | 2024-02-17 |
| PoC in GitHub | e11i0t4lders0n/CVE-2023-36845 | 2024-02-18 |
| PoC in GitHub | kopfjager007/CVE-2023-36845 | 2025-11-24 |
| Nuclei | Juniper J-Web - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36845 is a critical vulnerability (CVSS 9.8) in Juniper Junos, published August 17, 2023. CISA lists it as known to be exploited, since November 13, 2023. EUVD reports exploitation since November 13, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 95.1%, the 99th percentile. No source names a fixed version.
References
supportportal.juniper.net/JSA72300
packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36845
nvd.nist.gov/vuln/detail/CVE-2023-36845
github.com/advisories/GHSA-q56g-qr28-qh57