The JSI Virtual Lightweight Collector (vLWC) ships with a predetermined high‑privileged account password that is never required to be changed during first‑time provisioning. If the password is left at its default value, an attacker can authenticate using those credentials and obtain full administrative control over the device. This allows the compromise of confidentiality, integrity, and availability of the system, because the attacker can reconfigure settings, access data, or disrupt operations. The weakness matches CWE‑1393, the use of default credentials.

All Juniper Networks JSI Virtual Lightweight Collector software images older than version 3.0.94 are impacted. Older releases still contain the default high‑privileged password and thus remain vulnerable. Vendors recommend upgrading to release 3.0.94 or newer.

The vulnerability scores a 9.3 on the CVSS scale, indicating critical severity. EPSS score: < 1%, and the issue is not listed in the CISA KEV catalog. The CVE description states that an unauthenticated, network‑based attacker can reach the device’s management interface. It is inferred from this that the attacker requires no prior foothold, making the attack vector straightforward. Therefore the risk level is high and exploitation is likely under suitable conditions.