Security News > 2023 > August > Exploit released for Juniper firewall bugs allowing RCE attacks
Proof-of-concept exploit code has been publicly released for vulnerabilities in Juniper SRX firewalls that, when chained, can allow unauthenticated attackers to gain remote code execution in Juniper's JunOS on unpatched devices.
Juniper disclosed four medium-severity bugs in its EX switches and SRX firewalls and released security patches two weeks ago.
The security flaws were found in the PHP-based J-Web interface that admins can use to manage and configure Juniper devices on their networks.
WatchTowr Labs security researchers have since developed and released a proof-of-concept exploit that chains the SRX firewall flaws, a missing authentication for critical function vulnerability and a PHP external variable modification bug.
While Juniper has not provided any info on active exploitation of the security flaws in the wild, watchTowr Labs expects attackers to soon start targeting Juniper devices left unpatched in widescale attacks.
New PaperCut critical bug exposes unpatched servers to RCE attacks.
News URL
Related news
- Craft CMS RCE exploit chain used in zero-day attacks to steal data (source)
- PoisonSeed Exploits CRM Accounts to Launch Cryptocurrency Seed Phrase Poisoning Attacks (source)
- CISA Warns of CentreStack's Hard-Coded MachineKey Vulnerability Enabling RCE Attacks (source)
- Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now (source)
- Critical Erlang/OTP SSH RCE bug now has public exploits, patch now (source)
- Active! Mail RCE flaw exploited in attacks on Japanese orgs (source)
- Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks (source)
- How cybercriminals exploit psychological triggers in social engineering attacks (source)
- Samsung MagicINFO 9 Server RCE flaw now exploited in attacks (source)
- PoC exploit for SysAid pre-auth RCE released, upgrade quickly! (source)