CVE-2023-36851 KEV
Patch first
On CISA KEV — known exploited in the wild, due 2023-11-17.
Description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of integrity or confidentiality, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * 21.2 versions prior to 21.2R3-S8; * 21.4 versions prior to 21.4R3-S6; * 22.1 versions prior to 22.1R3-S5; * 22.2 versions prior to 22.2R3-S3; * 22.3 versions prior to 22.3R3-S2; * 22.4 versions prior to 22,4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S2, 23.2R2.
Scoring
| CVSS | 5.3 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| EPSS | 1.12% — more likely to be exploited than 65% of all CVEs |
| Weakness | CWE-306 |
| On CISA KEV | yes — remediate by 2023-11-17 |
| Public exploit | none known |
| Published | 2023-09-27 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability |
|---|---|
| Added | 2023-11-13 |
| Due | 2023-11-17 |
| Vendor / product | Juniper / Junos OS |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| juniper | ex2200 |
| juniper | ex2200-c |
| juniper | ex2200-vc |
| juniper | ex2300 |
| juniper | ex2300-24mp |
| juniper | ex2300-24p |
| juniper | ex2300-24t |
| juniper | ex2300-48mp |
| juniper | ex2300-48p |
| juniper | ex2300-48t |
| juniper | ex2300-c |
| juniper | ex2300m |
| juniper | ex3200 |
| juniper | ex3300 |
| juniper | ex3300-vc |
| juniper | ex3400 |
| juniper | ex4200 |
| juniper | ex4200-vc |
| juniper | ex4300 |
| juniper | ex4300-24p |
| juniper | ex4300-24p-s |
| juniper | ex4300-24t |
| juniper | ex4300-24t-s |
| juniper | ex4300-32f |
| juniper | ex4300-32f-dc |
| juniper | ex4300-32f-s |
| juniper | ex4300-48mp |
| juniper | ex4300-48mp-s |
| juniper | ex4300-48p |
| juniper | ex4300-48p-s |
| juniper | ex4300-48t |
| juniper | ex4300-48t-afi |
| juniper | ex4300-48t-dc |
| juniper | ex4300-48t-dc-afi |
| juniper | ex4300-48t-s |
| juniper | ex4300-48tafi |
| juniper | ex4300-48tdc |
| juniper | ex4300-48tdc-afi |
| juniper | ex4300-mp |
| juniper | junos |
References
→ the Explorer · watch your stack · NVD