InfoSecBulletin Cybersecurity for mankind
Juniper Networks released security updates to fix a critical vulnerability in its SRX Series firewalls and EX Series switches. The vulnerability allows remote code execution (RCE) without authentication.
A critical security flaw named CVE-2024-21591 was found in devices’ J-Web configuration interfaces. It can be exploited by unauthenticated attackers to gain root privileges or launch denial-of-service (DoS) attacks on unpatched devices.
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
CVE-2025-24054
Hackers Exploiting NTLM Spoofing Windows Vuln the in Wild
Bengaluru firm got ransomware attack, Hacker demanded $70,000
MITRE warns: U.S. Govt. Funding for MITRE’s CVE Ends Today
PwC exits more than a dozen countries in push to avoid scandals: FT reports
Australian Cyber Security Centre Alert for Fortinet Products
Top 10 Malware Threats of the Week: Reports ANY.RUN
Hackers Exploit Ivanti VPN Vulns 12 Countries to Infiltrate Multiple Orgs
“This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory,” the company explained in a security advisory published Wednesday.
Juniper stated that they have found no evidence of the vulnerability being exploited in the real world.
The list of vulnerable Junos OS versions affected by the SRX Series and EX Series J-Web bug is:
Junos OS versions earlier than 20.4R3-S9
Junos OS 21.2 versions earlier than 21.2R3-S7
Junos OS 21.3 versions earlier than 21.3R3-S5
Junos OS 21.4 versions earlier than 21.4R3-S5
Junos OS 22.1 versions earlier than 22.1R3-S4
Junos OS 22.2 versions earlier than 22.2R3-S3
Junos OS 22.3 versions earlier than 22.3R3-S2
Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3
“The bug has been fixed in all subsequent Junos OS releases from 20.4R3-S9 onwards.”
Admins are advised to promptly update their security or upgrade JunOS to the latest version; alternatively, disable the J-Web interface to eliminate the attack possibility.
Another temporary workaround is to restrict J-Web access to only trusted network hosts until patches are deployed.
According to data from nonprofit internet security organization Shadowserver, more than 8,200 Juniper devices have their J-Web interfaces exposed online, most from South Korea (Shodan also tracks over 9,000).
In November, CISA warned about a Juniper exploit called Juniper pre-auth RCE. It is being used by hackers and consists of four bugs known as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847. This exploit affects Juniper’s SRX firewalls and EX switches.
