Juniper J-Web: four medium flaws, one critical chain

CVE-2023-36845 lets an attacker change the environment of the J-Web page, and scores 9.8. The four others, CVE-2023-36844, 36846, 36847 and 36851, each look minor.

Juniper's advisory says they can be combined into remote code execution before authentication. Within weeks, Juniper added that 36845 works on its own.

J-Web only has to be enabled and reachable. No account, low complexity, and nobody has to click anything.

If J-Web listens on an interface that faces the Internet, anyone can try.

Each flaw alone opens a small gap: a setting that should not be changeable, a file that should not be accepted.

Chained together, the gaps line up, and code runs on the device. Four medium findings, one critical outcome.

Code execution on a switch or firewall that sees and steers your traffic.

And in 2025, a separate Junos flaw, CVE-2025-21590, let someone who already had shell access run malware past the Junos integrity protection. Juniper investigated malware found on its routers, and CISA listed the flaw one day after the advisory.

Upgrade Junos to a fixed release. Juniper's workaround is simple: disable J-Web, or limit it to trusted hosts only.

For the 2025 flaw, restrict shell access to trusted users, and scan routers with the Juniper Malware Removal Tool, which ships with Junos.

NacTrack reads each Junos device's version and matches it against Juniper's advisories, with CISA's known exploited flag.

Sources: CISA KEV, Juniper JSA72300, JSA93446 and JSA95385, NVD, CISA AA24-317A.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.