Junos OS (SRX firewalls)
CVE-2024-21620: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSS
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series, EX Series) 0 | 20.4R3-S10 or later |
| Junos OS (SRX Series, EX Series) 21.2 | 21.2R3-S8 or later |
| Junos OS (SRX Series, EX Series) 21.4 | 21.4R3-S6 or later |
| Junos OS (SRX Series, EX Series) 22.1 | 22.1R3-S5 or later |
| Junos OS (SRX Series, EX Series) 22.2 | 22.2R3-S3 or later |
| Junos OS (SRX Series, EX Series) 22.3 | 22.3R3-S2 or later |
| Junos OS (SRX Series, EX Series) 22.4 | 22.4R3-S1 or later |
| Junos OS (SRX Series, EX Series) 23.2 | 23.2R2 or later |
| Junos OS (SRX Series, EX Series) 23.4 | 23.4R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.
A specific invocation of the emit_debug_note method in webauth_operation.php will echo back the data it receives.
This issue affects Juniper Networks Junos OS on SRX Series and EX Series: * All versions earlier than 20.4R3-S10; * 21.2 versions earlier than 21.2R3-S8; * 21.4 versions earlier than 21.4R3-S6; * 22.1 versions earlier than 22.1R3-S5; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S2; * 22.4 versions earlier than 22.4R3-S1; * 23.2 versions earlier than 23.2R2; * 23.4 versions earlier than 23.4R2.
Workarounds
Disable J-Web, or limit access to only trusted hosts and users.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.