Description
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
NVD enrichment (full description, CVSS vector, CWEs) has not completed for this CVE yet — shown above is the CISA KEV short description only.
Scoring
- CVSS: Not yet available
- EPSS exploitation probability: Not yet available
- EPSS percentile: Not yet available
CISA KEV status
- Added to KEV: 2023-11-13
- Remediation due date: 2023-11-17
- Known ransomware campaign use: Unknown
More from Juniper
- CVE-2015-7755 — ScreenOS
- CVE-2025-21590 — Junos OS
- CVE-2023-36845 — Junos OS
- CVE-2023-36847 — Junos OS
- CVE-2023-36851 — Junos OS