JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access (Juniper Networks JSI LWC)

CVE-2026-33784

CRITICAL 9.3

En bref

Source: NVD
EPSS: EPSS 0.46 % · centile 40 (2026-10-31)
État: PUBLISHED
Publiée: 2026-04-09 21:36 UTC
Mise à jour: 2026-04-13 18:06 UTC
Attribuée par: juniper
Statut NVD: Analyzed

Rechercher sur…

Description

A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

Faiblesses (CWE)

CWE-1393 — Use of Default Password

Références

https://kb.juniper.net/JSA107871

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	juniper
CVSS 4.0	CRITICAL 9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:L	juniper
CVSS 4.0	CRITICAL 9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:X	NVD · sirt@juniper.net (Secondary)
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · sirt@juniper.net (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-21203
GCVE · GCVE-0-2026-33784

Avis du CERT-FR

CERTFR-2026-AVI-0408 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:juniper:virtual_lightweight_collector:*:*:*:*:*:*:*:* < 3.0.94

Produits affectés

Produit	Versions
Juniper Networks · JSI LWC	affected 0 < 3.0.94

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access (Juniper Networks JSI LWC)