CVE-2026-33784 | THREATINT

Description

A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.

PUBLISHED Reserved 2026-03-23 | Published 2026-04-09 | Updated 2026-04-13 | Assigner juniper

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:L

Problem types

CWE-1393 Use of Default Password

Product status

Default status

unaffected

Any version before 3.0.94

affected

References

kb.juniper.net/JSA107871 vendor-advisory

cve.org (CVE-2026-33784)

nvd.nist.gov (CVE-2026-33784)

Download JSON