Junos OS (SRX firewalls)
CVE-2023-36846: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 0 | 20.4R3-S8 or later |
| Junos OS (SRX Series) 21.1 | 21.1* or later |
| Junos OS (SRX Series) 21.2 | 21.2R3-S6 or later |
| Junos OS (SRX Series) 21.3 | 21.3R3-S5 or later |
| Junos OS (SRX Series) 21.4 | 21.4R3-S5 or later |
| Junos OS (SRX Series) 22.1 | 22.1R3-S3 or later |
| Junos OS (SRX Series) 22.2 | 22.2R3-S2 or later |
| Junos OS (SRX Series) 22.3 | 22.3R2-S2, 22.3R3 or later |
| Junos OS (SRX Series) 22.4 | 22.4R2-S1, 22.4R3 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
- All versions prior to 20.4R3-S8;
- 21.1 versions 21.1R1 and later;
- 21.2 versions prior to 21.2R3-S6;
- 21.3 versions
prior to
21.3R3-S5; * 21.4 versions
prior to
21.4R3-S5; * 22.1 versions
prior to
22.1R3-S3; * 22.2 versions
prior to
22.2R3-S2; * 22.3 versions
prior to
22.3R2-S2, 22.3R3; * 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Am I affected?
The following minimal configuration is necessary:
[system services web-management http]or
[system services web-management https]
Workarounds
Disable J-Web, or limit access to only trusted hosts.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
CISA lists this CVE as exploited in the wild since 13 Nov 2023.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.