CVE-2026-33784— JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33784
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access
Source: NVD (National Vulnerability Database)
Vulnerability Description
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1393
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juniper Networks Support Insights Virtual Lightweight Collector 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Networks Support Insights Virtual Lightweight Collector是美国瞻博网络（Juniper Networks）公司的一款网络设备遥测数据采集与运维分析辅助组件。 Juniper Networks Support Insights Virtual Lightweight Collector 3.0.94之前版本存在安全漏洞，该漏洞源于使用默认密码，可能导致攻击者完全控制设备。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | JSI LWC | 0 ~ 3.0.94 | - |
II. Public POCs for CVE-2026-33784
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33784
请登录查看更多情报信息。
Same Patch Batch · Juniper Networks · 2026-04-09 · 26 CVEs total
| CVE-2026-33785 | 8.8 HIGH | Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands in a JDM/CS |
| CVE-2025-13914 | 8.7 HIGH | Apstra: SSH host key validation vulnerability for managed devices |
| CVE-2026-33793 | 7.8 HIGH | Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, |
| CVE-2026-33788 | 7.8 HIGH | Junos OS Evolved: Local, authenticated attacker can gain privileged access to FPCs |
| CVE-2026-33790 | 7.5 HIGH | Junos OS: SRX Series: In a NAT64 configuration, receipt of a specific, malformed ICMPv6 pa |
| CVE-2026-33778 | 7.5 HIGH | Junos OS: SRX Series, MX Series: When a specifically malformed first ISAKMP packet is rece |
| CVE-2026-33771 | 7.4 HIGH | CTP OS: Configuring password requirements does not work which permits the use of weak pass |
| CVE-2026-33797 | 7.4 HIGH | Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a |
| CVE-2026-21916 | 7.3 HIGH | Junos OS: A low privileged user can escalate their privileges so that they can login as ro |
| CVE-2026-33791 | 6.7 MEDIUM | Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shel |
| CVE-2026-21915 | 6.7 MEDIUM | JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root |
| CVE-2026-33780 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: In an EVPN-MPLS scenario churn of ESI routes causes a memor |
| CVE-2025-59969 | 6.5 MEDIUM | Junos OS Evolved: QFX5000 Series and PTX Series: An attacker sending crafted multicast pac |
| CVE-2026-21919 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: A high frequency of connecting and disconnecting NETCONF se |
| CVE-2026-33781 | 6.5 MEDIUM | Junos OS: EX Series, QFX Series: In a VXLAN scenario when specific control protocol packet |
| CVE-2026-33782 | 6.5 MEDIUM | Junos OS: MX Series: In specific DHCPv6 scenarios jdhcpd memory increases continuously wit |
| CVE-2026-33775 | 6.5 MEDIUM | Junos OS: MX Series: Mismatch between configured and received packet types causes memory l |
| CVE-2026-33779 | 6.5 MEDIUM | Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communi |
| CVE-2026-33783 | 6.5 MEDIUM | Junos OS Evolved: PTX Series: If SRTE tunnels provisioned via PCEP are present and specifi |
| CVE-2026-33774 | 6.5 MEDIUM | Junos OS: MX Series: Firewall filters on lo0.<non-0> in the default routing instance are n |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Juniper Networks
- CVE-2026-33791
Junos OS and Junos OS Evolved: Execution of crafted CLI comm - CVE-2026-33790
Junos OS: SRX Series: In a NAT64 configuration, receipt of a - CVE-2026-33787
Junos OS: SRX1500, SRX4100, SRX4200, SRX4600: When a specifi - CVE-2026-33785
Junos OS: MX Series: Missing Authorization for specific 'req - CVE-2026-33783
Junos OS Evolved: PTX Series: If SRTE tunnels provisioned vi
Same weakness: CWE-1393
- CVE-2025-14917
IBM WebSphere Application Server Liberty could provide weake - CVE-2026-3186
feiyuchuixue sz-boot-parent Password Reset password default - CVE-2026-2635
MLflow Use of Default Password Authentication Bypass Vulnera - CVE-2026-24429
Tenda W30E V2 Hardcoded Default Password for Built-in Accoun - CVE-2025-66050
No password set for administrative account in Vivotek IP7137
V. Comments for CVE-2026-33784
No comments yet