Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Aug 17, 2023 · Catalog

   Detected

   A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file s

2. Nov 13, 2023 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Nov 17, 2023 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file s

Affected

• cpe juniper/junosversion unspecified
• cpe juniper/junos20.4
• vendor Juniper Junos OSversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2023-36846

  Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the fil

  cisa.gov
• CVE.orgVulnerability recordCVE-2023-36846

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2023-36846

  30-day exploitation probability 93.5%

  first.org
• NIST NVDVulnerability recordCVE-2023-36846

  A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authenticati

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Vendor Advisory · supportportal.juniper.net
• CISA note · supportportal.juniper.net
• US Government Resource · cisa.gov