CVE-2023-36851: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Summary: Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability, CVE-2023-36851, that lets an unauthenticated, network-based attacker send a specific request to webauth_operation.php and upload arbitrary files via J-Web. The result is a loss of integrity for part of the file system, which may allow chaining to other vulnerabilities, and CISA set a remediation due date of 2023-11-17.
Bottom line: An unauthenticated request to a single J-Web endpoint is enough to write files onto the device, and the source notes that this may be chained to other vulnerabilities - so the file upload is a foothold, not the end state. CISA's due date of 2023-11-17 puts this on a fixed clock for any SRX Series device still exposed.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-36851Juniper
- Related
- CVE-2015-7755: Juniper ScreenOS Improper Authentication Vulnerability Known Exploited Vulnerabilities · Oct 02, 2025CVE-2025-21590: Juniper Junos OS Improper Isolation or Compartmentalization Vulnerability Known Exploited Vulnerabilities · Mar 13, 2025CVE-2023-36847: Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Nov 13, 2023