Critical RCE vulnerabilities in Juniper Firewalls & switches

Juniper Networks has released security updates to fix a critical pre-auth remote code execution (RCE) vulnerability in its SRX Series firewalls and EX Series switches.

The vulnerability resides in the devices’ J-Web configuration interfaces, an unauthenticated attacker can exploit the vulnerability to get root privileges or launch denial-of-service (DoS) attacks against unpatched devices.

"This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory," the company explained in a security advisory published Wednesday.

“An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device.” reads the advisory published by the vendor.

“This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory.”

This vulnerability affects Juniper Networks Junos OS SRX Series and EX Series:

Junos OS versions earlier than 20.4R3-S9;

Junos OS 21.2 versions earlier than 21.2R3-S7;

Junos OS 21.3 versions earlier than 21.3R3-S5;

Junos OS 21.4 versions earlier than 21.4R3-S5;

Junos OS 22.1 versions earlier than 22.1R3-S4;

Junos OS 22.2 versions earlier than 22.2R3-S3;

Junos OS 22.3 versions earlier than 22.3R3-S2;

Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.

Juniper SIRT is not aware of any attacks exploiting this vulnerability in the wild.

Admins are advised to immediately apply the security updates or upgrade JunOS to the latest release or, at least, disable the J-Web interface to remove the attack vector. Another temporary workaround is to restrict J-Web access to only trusted network hosts until patches are deployed.

​CISA also warned in November of a Juniper pre-auth RCE exploit used in the wild, chaining four bugs tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847 and impacted the company's SRX firewalls and EX switches.

The U.S. cybersecurity agency issued the first binding operational directive (BOD) of the year last June, requiring federal agencies to secure their Internet-exposed or misconfigured networking equipment (such as Juniper firewalls and switches) within a two-week window following discovery.