Junos OS (SRX firewalls)
CVE-2023-36851: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series) 21.2 | 21.2R3-S8 or later |
| Junos OS (SRX Series) 21.4 | 21.4R3-S6 or later |
| Junos OS (SRX Series) 22.1 | 22.1R3-S5 or later |
| Junos OS (SRX Series) 22.2 | 22.2R3-S3 or later |
| Junos OS (SRX Series) 22.3 | 22.3R3-S2 or later |
| Junos OS (SRX Series) 22.4 | 22.4R2-S2, 22.4R3 or later |
| Junos OS (SRX Series) 23.2 | 23.2R1-S2, 23.2R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to
webauth_operation.php
that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of
integrity or confidentiality, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
*
21.2 versions prior to 21.2R3-S8; * 21.4
versions prior to
21.4R3-S6; * 22.1
versions prior to
22.1R3-S5; * 22.2
versions prior to
22.2R3-S3; * 22.3
versions prior to
22.3R3-S2; * 22.4 versions prior to 22,4R2-S2, 22.4R3; * 23.2 versions prior to
23.2R1-S2, 23.2R2.
Am I affected?
The following minimal configuration is necessary:
[system services web-management http]or
[system services web-management https]
Workarounds
Disable J-Web, or limit access to only trusted hosts.
Exploitation
While Juniper SIRT is not aware of a successful exploit against a customer, a proof of concept has been published and exploit attempts have been detected.
CISA lists this CVE as exploited in the wild since 13 Nov 2023.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.