CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
- Published
- Aug 17, 2023
- Updated
- Oct 21, 2025
- Assigning CNA
- juniper
- Evidence observed
- Nov 13, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
Sources
modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb
Metasploit Framework modulesDeclared conditions
- platform: PHP,Unix($.exploit_freebsd/http/junos_phprc_auto_prepend_file.platform)
- verification: check_declared($.exploit_freebsd/http/junos_phprc_auto_prepend_file.check)
http/cves/2023/CVE-2023-36845.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: regex,status,word($.matchers[*].type)
This Python script automates the Proof of Concept (PoC) for CVE-2023-36845, a vulnerability impacting Juniper Networks Junos OS on EX and SRX Series devices. The vulnerability resides in the J-Web component, allowing remote manipulation of the PHPRC variable, potentially leading to code injection.
- CVE-2023-36845Scanner
CVES
Exploit for CVE-2023-36845, a PHP environment variable manipulation vulnerability in Juniper SRX/EX, enabling unauthenticated remote code execution via crafted HTTP requests.
Automated PoC script for CVE-2023-36845, exploiting a PHP flaw in Juniper Junos OS J-Web to remotely modify PHPRC and achieve code injection on EX/SRX devices.
- CVE-2023-36845Scanner
Shell-based scanner for CVE-2023-36845, an unauthenticated remote code execution vulnerability in Juniper J-Web, enabling environment variable manipulation on EX/SRX series.
- CVE-2023-36845Exploit
Scanner for CVE-2023-36845 with Shodan and Censys integration for automated host discovery and exploitation of Juniper devices.
- CVE-2023-36845-6-Exploit
CVE-2023-36845 и CVE-2023-36846 Juniper Junos OS J-Web RCE
Juniper RCE (Remote Code Execution) CVE-2023-36845 is a vulnerability that has been identified within Juniper's software. This particular flaw allows for remote code execution, meaning an attacker could run arbitrary code on a system without needing physical access to the device.
- CVE-2023-36845Exploit
Proof-of-concept exploit for CVE-2023-36845 enabling unauthenticated remote code execution on Juniper SRX firewalls and EX switches via PHP environment variable manipulation.
A Proof of Concept for chaining the CVEs [CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847] to achieve Remote Code Execution (phpinfo) in Juniper JunOS within SRX and EX Series products.Modified from original exploit developed by @watchTowr .
- cve-2023-36845-scannerScanner
A go-exploit to scan for Juniper firewalls vulnerable to CVE-2023-36845
- juniper-rce_cve-2023-36844Exploit
Proof-of-concept exploit chaining four CVEs (CVE-2023-36844-47) for pre-authentication remote code execution on Juniper JunOS SRX and EX series firewalls via PHP file upload and configuration injection.
- CVE-2023-36845Exploit
CVE-2023-36845 - Juniper Firewall Remote code execution (RCE)
Simple Automation script for juniper cve-2023-36845
Bash script to automate detection of CVE-2023-36845 vulnerability in Juniper devices by sending crafted requests to a list of IP addresses.
- CVE-2023-36845Exploit
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code.
- CVE-2023-36845Exploit
Juniper JunOS J-Web PHP external variable modification (CVE-2023-36845) exploit.
- ansible-cve-2023-36845Scanner
Ansible Playbook for CVE-2023-36845(Juniper Networks Junos OS Remote Code Execution Vulnerability)
- CVE-2023-36845Exploit
Mass-check script for CVE-2023-36845 that scans IP lists and tests for remote file inclusion via PHP configuration injection.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.