LIVE NEWSROOM · --:-- · May 25, 2026
A LIBRARY FOR SECURITY RESEARCHERS

CVE DATABASE  /  CVE-2023-36845

CVE-2023-36845

Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

CVSS 9.8 · CRITICAL ⚠ CISA KEV — ACTIVELY EXPLOITED
On the CISA KEV catalog

Confirmed exploited in the wild. Added 2023-11-13. Federal remediation due 2023-11-17.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Summary

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Seriesand SRX Seriesallows an unauthenticated, network-based attacker to remotely execute code.Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.This issue affects Juniper Networks Junos OS on EX SeriesandSRX Series:* All versions prior to20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versionsprior to22.1R3-S4; * 22.2 versionsprior to22.2R3-S2; * 22.3 versionsprior to22.3R2-S2, 22.3R3-S1; * 22.4 versionsprior to22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

CVSS 3.1 breakdown

Base score9.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vectorNETWORK
Attack complexityLOW
Privileges requiredNONE
User interactionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH

Weakness type (CWE)

Affected products

Juniper junosJuniper srx100Juniper srx110Juniper srx1400Juniper srx1500Juniper srx210Juniper srx220Juniper srx240Juniper srx240h2Juniper srx240mJuniper srx300Juniper srx320Juniper srx340Juniper srx3400Juniper srx345Juniper srx3600Juniper srx380Juniper srx4000Juniper srx4100Juniper srx4200
Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

Data: NIST NVD + CISA KEV. NVD last modified 2025-10-24. Always verify against the vendor advisory before acting.

Scroll to Top