Paper/Archive/CVE-2026-33784

CVE-2026-33784

Juniper Networks JSI LWC — JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 39.6.396 × 207.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

Affected

ProductAffectedFixed inSource

JSI LWC< 3.0.943.0.94CNA

Scores by source

juniper (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

juniper (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:L

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorykb.juniper.net/JSA107871