Which versions of Brute Force are affected by CVE-2026-33771?

Juniper Networks CTP OS versions 9.2R1 and 9.2R2 contain a critical password management flaw where configured complexity requirements fail to persist, allowing attackers to brute-force weak default…

How to fix or mitigate CVE-2026-33771?

Within 24 hours: Inventory all Juniper CTP OS deployments and identify systems running 9.2R1 or 9.2R2; immediately isolate or restrict network access to affected devices. Within 7 days: Contact Juniper Networks support to confirm patch availability timeline and request security guidance; implement compensating controls (network segmentation, access controls, enhanced monitoring). Within 30 days: Deploy vendor patch immediately upon release or migrate to unaffected OS versions; conduct password audits and reset all local account credentials on CTP devices.

Brute Force CVE-2026-33771

Q: What is the CVSS score of CVE-2026-33771?

CVE-2026-33771 has a CVSS 4.0 base score of 9.1 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21193 CRITICAL

Weak Password Requirements (CWE-521)

2026-04-09 sirt@juniper.net

GHSA-p36j-9x33-56jq

Authentication Bypass Juniper Brute Force Ctop Os

9.1

CVSS 4.0 · Vendor: juniper

Severity by source

Vendor (juniper) PRIMARY

9.1 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X

Primary rating from Vendor (juniper) · only source for this CVE.

CVSS VectorVendor: juniper

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 22:22 euvd

EUVD-2026-21193

Analysis Generated

Apr 09, 2026 - 22:22 vuln.today

CVE Published

Apr 09, 2026 - 22:16 nvd

CRITICAL 9.1

DescriptionCVE.org

A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device.

The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access.

This issue affects CTP OS versions 9.2R1 and 9.2R2.

AnalysisAI

Juniper Networks CTP OS 9.2R1 and 9.2R2 fail to persist password complexity settings, enabling unauthenticated attackers to exploit predictable weak passwords on local accounts. The password management function allows administrators to configure complexity requirements but does not save these configurations, verifiable through 'Show password requirements' menu. This defect permits trivial passwords that attackers can brute-force remotely to gain full device control. No public exploit identified at time of analysis.

Technical ContextAI

CWE-521 (Weak Password Requirements) stems from configuration persistence failure in password policy enforcement code. Settings accepted via administrative interface fail database commit, leaving default null requirements active. CVSS:4.0 vector PR:N confirms unauthenticated remote attack surface. Affects password hash comparison logic vulnerable to dictionary attacks.

RemediationAI

Vendor-released patch details available in Juniper Security Advisory JSA107864 at https://kb.juniper.net/JSA107864 - consult advisory for specific fixed release version and upgrade path. Immediate mitigations: (1) manually audit all local account passwords against organizational complexity policy and force resets for non-compliant credentials; (2) implement network-layer access controls restricting management interface exposure to trusted administrative subnets only; (3) enable multi-factor authentication if supported; (4) deploy intrusion detection monitoring for repeated failed authentication attempts indicating brute-force activity. Verify password requirement persistence post-patching using 'Show password requirements' validation.