CVE‑2023‑36845: Unauthenticated Remote Code Execution in Juniper Junos OS (EX & SRX Series)
What It Is – Juniper Junos OS on EX Series switches and SRX Series firewalls contains a PHP external‑variable modification flaw. An attacker can send a crafted HTTP request that overwrites the PHPRC environment variable, altering the PHP execution environment and enabling arbitrary code injection.
Exploitability – The vulnerability is network‑reachable and requires no authentication. Public proof‑of‑concept code has been released, giving attackers a straightforward path to remote code execution. (CVSS ≥ 7.5 – high).
Affected Products – Juniper Junos OS running on EX Series Ethernet switches and SRX Series services gateways (all versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration management controls that verify critical system settings (e.g., PHP environment variables) remain immutable.
- Highlights the importance of continuous monitoring to detect unauthorized changes to runtime configurations across network devices.
- Provides audit evidence that an organization is actively managing and evidencing configuration baselines—a key trust signal for buyers and regulators.
Recommended Actions
- Apply Juniper’s security patch for CVE‑2023‑36845 immediately.
- Verify the
PHPRCvariable and other PHP runtime settings are locked down to approved values. - Incorporate the configuration check into your continuous compliance monitoring platform and capture the result as evidence of control effectiveness.
- Update your configuration‑baseline documentation and map the remediation to the “secure configuration management” control objective in your framework of record.
Source: CISA KEV – CVE‑2023‑36845