CVE-2026-33771
Last modified
CVE-2026-33771 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access. This issue affects CTP OS versions 9.2R1 and 9.2R2.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Juniper | Ctp Operating System | 9.2 | R1 |
References
- https://kb.juniper.net/JSA107864Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33771?
How severe is CVE-2026-33771?
How do I fix CVE-2026-33771?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33766WWBN AVideo is an open source video platform. In versions up…6.5
- CVE-2026-33767WWBN AVideo is an open source video platform. In versions up…8.8
- CVE-2026-33768Astro is a web framework. Prior to version 10.0.2, the @astr…9.1
- CVE-2026-33769Astro is a web framework. From version 2.10.10 to before ver…5.3
- CVE-2026-3377A vulnerability was detected in Tenda F453 1.0.0.3. Affected…8.8
- CVE-2026-33770WWBN AVideo is an open source video platform. In versions up…9.8
- CVE-2026-33773An Incorrect Initialization of Resource vulnerability in the…6.9
- CVE-2026-33774An Improper Check for Unusual or Exceptional Conditions vuln…5.3
- CVE-2026-33775A Missing Release of Memory after Effective Lifetime vulnera…7.1
- CVE-2026-33776A Missing Authorization vulnerability in the CLI of Juniper …6.8
- CVE-2026-33778An Improper Validation of Syntactic Correctness of Input vul…8.7
- CVE-2026-33779An Improper Following of a Certificate's Chain of Trust vuln…8.3
Are you affected by CVE-2026-33771?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST