CVE-2023-36845
CISA 기관 조치 기한: 2023-11-17
Juniper Junos OS
Qualys 위협 인텔 · 심각도 3/5 · QID 44099 · Hardware
공개 익스플로잇
실제 공격 관측
쉬운 악용
악성코드 연계
웜 전파
인증 불필요
원격코드실행
랜섬웨어 연계
CISA KEV
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
KEV 필수 조치: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
공개 익스플로잇 / PoC
- GitHub 공개 PoC 20건 — 대표 레포 ↗