Junos OS - RCE (CVE-2023-36844)
Description
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables.
psychologyCrowdSec Analysis
CVE-2023-36844 is a vulnerability in the J-Web interface of Juniper Networks Junos OS, which enables unauthenticated attackers to modify critical environment variables through crafted requests.
CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2025.
CrowdSec network data shows that most actors exploiting CVE-2023-36844 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-36844 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-36844 is currently experiencing high visibility and active exploitation across the internet.
Observed attack patterns are aimed at the /webauth_operation.php endpoint, focusing on systems with publicly exposed interfaces.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-08-17 |
| CISA KEV | 2023-11-13 |
| CISA Remediation Deadline | 2023-11-17 |
| Rule Released | 2025-04-01 |
| CrowdSec First Seen | 2025-04-01 |