CVE-2022-22246 - CVE House
Back to Database
Status published High CVE-2022-22246

Junos OS: PHP file inclusion vulnerability in J-Web

Vulnerability Description

A PHP Local File Inclusion (LFI) vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute an untrusted PHP file. By chaining this vulnerability with other unspecified vulnerabilities, and by circumventing existing attack requirements, successful exploitation could lead to a complete system compromise. This issue affects Juniper Networks Junos OS: all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S2; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R1-S2, 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-22246

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Juniper SIRT would like to acknowledge and thank Paulos Yibelo from Octagon Networks (octagon.net) for responsibly reporting this vulnerability.

References

More from Juniper Networks

View All →
CVE-2025-6549
Junos OS: SRX Series: J-Web can be exposed on additional interfaces
Medium 6.9
CVE-2025-60011
Junos OS and Junos OS Evolved: Optional transitive BGP attribute is modified before propagation to peers causing sessions to flap
Medium 6.9
CVE-2025-60010
Junos OS and Junos OS Evolved: Device allows login for user with expired password
Medium 5.3
CVE-2025-60009
Junos Space: CLI Configlet page is vulnerable to reflected cross-site script injection
Medium 5.1
CVE-2025-60007
Junos OS: A specifically crafted 'show chassis' command causes chassisd to crash
Medium 6.8

Affected Vendor

Juniper Networks

View all reports →

Affected Software

Junos OS
Vulnerable Versions:
unspecified, 19.2, 19.3, 19.4, 20.1, 20.2, 20.3, 20.4, 21.1, 21.2, 21.3, 21.4, 22.1

Timeline

Official Publish: October 18th, 2022
Last Modified: May 9th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-829

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.