EUVD-2026-21203
GHSA-g6hm-r7f2-4j2f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover vLWC device on network
-
DeliveryConnect with default credentials
-
ExploitAuthenticate as privileged account
-
ExecutionExecute arbitrary commands
-
ImpactGain full system control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default password prevention
|
| Exploitation Conditions | Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) versions before 3.0.94 ship with default high-privilege account credentials. Unauthenticated remote attacker can login with unchanged default password if password change is not enforced during provisioning. No victim interaction required. |
| Impact | Critical severity (CVSS 9.3) with unauthenticated network access and complete system compromise. Default credentials bypass all authentication; no remediation required from attacker. High-value target for initial infrastructure access. Immediate patching to 3.0.94+ mandatory for exposed instances, particularly in managed security service provider deployments. |
| Exploit ScenarioDerived | Attacker connects over network to vLWC management interface, authenticates using default credentials documented in JSI documentation or discovered via public resources, gains full administrative control. Single-step unauthenticated exploitation; no complexity barriers or user interaction required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Full device takeover in Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) before 3.0.94 via hardcoded default credentials. The vLWC software ships with an unchangeable initial password for a high-privileged account with no enforced password change during provisioning, enabling unauthenticated remote attackers to gain complete system control. CVSS v4.0 score 9.3 (Critical). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Upgrade all vLWC deployments to version 3.0.94 or later immediately. For installations currently running affected versions, perform emergency password rotation for all high-privileged accounts before upgrade to prevent unauthorized access during migration window. Post-upgrade, validate that default credentials have been changed and implement monitoring for authentication attempts using legacy credential patterns. Disable remote management interfaces on affected systems until patching completes. Organizations unable to patch immediately must isolate vLWC instances behind strict network access controls restricting connectivity to trusted management networks only. Full vendor security advisory with upgrade instructions: https://kb.juniper.net/JSA107871
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-1393 use-of-default-credentials vulnerability. The vLWC provisioning workflow fails to mandate credential rotation for factory-set high-privilege accounts, leaving production deployments accessible via predictable authentication material embedded in the software image. Root cause is insufficient credential lifecycle enforcement in initial setup procedures.
Know when Virtual Lightweight Collector gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:Y/R:U/RE:L
Primary rating from Vendor (juniper) · only source for this CVE.
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Use of Default Password vulnerability in the Juniper Networks
Support Insights (JSI)
Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device.
vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94.
Executive ViewAI
Juniper Networks Support Insights vLWC versions before 3.0.94 contain hardcoded default credentials that allow unauthenticated attackers to achieve full device takeover, creating a critical remote access threat to any organization running affected versions. This vulnerability exposes infrastructure monitoring systems to complete compromise without requiring exploitation tools or user interaction, making immediate remediation essential.
Apply vendor patch. If patching cannot occur immediately: restrict network access to vLWC instances via firewall rules limiting connectivity to authorized administrative networks only; implement account lockout policies if supported; monitor authentication logs for failed and successful logins to high-privileged accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB