Junos OS - RCE (CVE-2023-36845)
151Exploiting IPs reported
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to remotely execute code.
CrowdSec analysis
CVE-2023-36845 is a critical vulnerability impacting the J-Web interface of Juniper Networks Junos OS, allowing unauthenticated remote code execution through a crafted PHP environment variable modification.
CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2025.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-36845 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-36845 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-36845 is currently experiencing high visibility and active exploitation across the internet.
Observed exploitation attempts commonly leverage URLs containing /?phprc=/dev/fd/0.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.