CVE-2023-36845

Confirmed PUBLISHED

Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

Juniper Networks · Junos OS

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical

At a Glance

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

cisa metasploit windows nuclei_scanner edge php

CVE Published: Aug 17, 2023
Exploitation Reported: Nov 13, 2023
CVSS: 9.8 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Juniper Networks	Junos OS	0 to < 20.4R3-S9	Affected
Juniper Networks	Junos OS	21.1 to < 21.1*	Affected
Juniper Networks	Junos OS	21.2 to < 21.2R3-S7	Affected
Juniper Networks	Junos OS	21.3 to < 21.3R3-S5	Affected
Juniper Networks	Junos OS	21.4 to < 21.4R3-S5	Affected
Juniper Networks	Junos OS	22.1 to < 22.1R3-S4	Affected
Juniper Networks	Junos OS	22.2 to < 22.2R3-S2	Affected
Juniper Networks	Junos OS	22.3 to < 22.3R2-S2, 22.3R3-S1	Affected
Juniper Networks	Junos OS	22.4 to < 22.4R2-S1, 22.4R3	Affected
Juniper Networks	Junos OS	23,2 to < 23.2R1-S1, 23.2R2	Affected

CVE References

Vendor Advisory — supportportal.juniper.net supportportal.juniper.net · Vendor Advisory https://supportportal.juniper.net/JSA72300
packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-S...
packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-S...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-11-13 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36845.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2023-11-13 00:00:00 UTC · CISA

Proof of concept available

Recorded 2023-09-26 17:56:55 UTC · GitHub

Weaknesses (CWE)

CWE-473

PHP External Variable Modification

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-36845.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

e11i0t4lders0n/CVE-2023-36845

github · Created 2024-02-18 15:37:58 UTC · 1 stars

CVE-2023-36845 – Unauthenticated Juniper Remote Code Execution Vulnerability Scanner

ifconfig-me/CVE-2023-36845

github · Created 2024-02-17 08:15:30 UTC · 0 stars

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code.

ak1t4/CVE-2023-36845

github · Created 2024-02-13 20:59:34 UTC · 5 stars

CVES

cyberh3als/CVE-2023-36845-POC

github · Created 2023-10-02 06:28:07 UTC · 2 stars

CVE-2023-36845 PoC script automates the PoC for CVE-2023-36845 targeting Juniper Networks Junos OS's J-Web component on EX and SRX Series devices. It exploits a PHP flaw, allowing remote modification of the PHPRC variable. Successful exploitation can lead to code injection and execution.

zaenhaxor/CVE-2023-36845

github · Created 2023-09-29 03:11:37 UTC · 3 stars

CVE-2023-36845 - Juniper Firewall Remote code execution (RCE)

kljunowsky/CVE-2023-36845

github · Created 2023-09-26 17:56:55 UTC · 51 stars

Juniper Firewalls CVE-2023-36845 - RCE

Juniper J-Web - Remote Code Execution

nuclei · Created Unknown

junos_phprc_auto_prepend_file

metasploit · Created Unknown

Metasploit module for CVE-2023-36845

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2023-36845

{
  "cve_id": "CVE-2023-36845",
  "title": "Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthent...",
  "affected_vendor": "Juniper Networks",
  "affected_product": "Junos OS",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2023-36845

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API