CVE-2026-33771
Weak Password Enforcement in Juniper CTP OS Enables Device Takeover
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: Juniper Networks, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| juniper_networks | ctp_os | to 9.2r1 (inc) |
| juniper_networks | ctp_os | to 9.2r2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-521 | The product does not require that users should have strong passwords. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the affected device by allowing attackers to guess weak passwords. This can potentially result in the attacker taking full control of the device, which may compromise the security and operation of the network infrastructure relying on the device.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability can be detected by checking the password complexity requirements settings on the affected Juniper Networks CTP OS devices. Specifically, the issue can be verified using the menu option "Show password requirements" to see if the intended password complexity settings are actually enforced.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, administrators should ensure that strong password complexity requirements are properly configured and enforced on the device. Since the password management menu settings are not saved by default, it is important to verify and reapply these settings as needed to prevent weak passwords from being used.
Can you explain this vulnerability to me?
This vulnerability is a Weak Password Requirements issue in the password management function of Juniper Networks CTP OS. It allows an unauthenticated, network-based attacker to exploit weak passwords of local accounts because the system does not save the password complexity settings set by the administrator. As a result, weak passwords can be used, increasing the chance that an attacker can guess them and gain unauthorized access to the device.