The JSI Virtual Lightweight Collector (vLWC) ships with a predetermined high‑privileged account password that is never required to be changed during first‑time provisioning. If the password is left at its default value, an attacker can authenticate using those credentials and obtain full administrative control over the device. This allows the compromise of confidentiality, integrity, and availability of the system, because the attacker can reconfigure settings, access data, or disrupt operations. The weakness matches CWE‑1393, the use of default credentials.

All Juniper Networks JSI Virtual Lightweight Collector software images older than version 3.0.94 are impacted. Older releases still contain the default high‑privileged password and thus remain vulnerable. Vendors recommend upgrading to release 3.0.94 or newer.

The vulnerability scores a 9.3 on the CVSS scale, indicating critical severity. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an unauthenticated, network‑based attacker can reach the device’s management interface and log in with the default credentials immediately after deployment, requiring no prior foothold. Therefore the risk level is high and exploitation is likely under suitable conditions.