CVE-2026-33784

A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.juniper.net/JSA107871	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:juniper:virtual_lightweight_collector:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de uso de contraseña por defecto en el Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) permite a un atacante no autenticado y basado en red tomar control total del dispositivo. Las imágenes de software de vLWC se distribuyen con una contraseña inicial para una cuenta con altos privilegios. Un cambio de esta contraseña no se exige durante el aprovisionamiento del software, lo que puede hacer posible el acceso total al sistema por actores no autorizados. Este problema afecta a todas las versiones de vLWC anteriores a la 3.0.94.

Information

Published : 2026-04-09 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33784

Mitre link : CVE-2026-33784

CVE.ORG link : CVE-2026-33784

JSON object : View

Products Affected

juniper

virtual_lightweight_collector

CWE

CWE-1393

Use of Default Password

NVD-CWE-noinfo

{"id": "CVE-2026-33784", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33784", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-13T17:54:25.395838Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "sirt@juniper.net", "affectedData": [{"vendor": "Juniper Networks", "product": "JSI LWC", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.94", "versionType": "semver"}], "platforms": ["vLWC"], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T22:16:27.820", "references": [{"url": "https://kb.juniper.net/JSA107871", "tags": ["Vendor Advisory"], "source": "sirt@juniper.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-1393"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A Use of Default Password vulnerability in the Juniper Networks \n\nSupport Insights (JSI) \n\nVirtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device.\n\nvLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94."}, {"lang": "es", "value": "Una vulnerabilidad de uso de contrase\u00f1a por defecto en el Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) permite a un atacante no autenticado y basado en red tomar control total del dispositivo.\n\nLas im\u00e1genes de software de vLWC se distribuyen con una contrase\u00f1a inicial para una cuenta con altos privilegios. Un cambio de esta contrase\u00f1a no se exige durante el aprovisionamiento del software, lo que puede hacer posible el acceso total al sistema por actores no autorizados. Este problema afecta a todas las versiones de vLWC anteriores a la 3.0.94."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:juniper:virtual_lightweight_collector:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF1FB888-3C5F-485F-BA71-83ED891665B1", "versionEndExcluding": "3.0.94"}], "operator": "OR"}]}], "sourceIdentifier": "sirt@juniper.net"}