CVE-2026-33784
JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
13th
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.
| CWE | CWE-1393 |
| Vendor | juniper networks |
| Product | jsi lwc |
| Published | Apr 9, 2026 |
| Last Updated | Apr 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for juniper networks jsi lwc
Be the first to know when new critical vulnerabilities affecting juniper networks jsi lwc are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Juniper Networks / JSI LWC
0 < 3.0.94