CVE-2026-33771: juniper networks ctp os Weak Password Requirements
Vulnerability summary
CVE-2026-33771 is a critical (CVSS 9.1) Weak Password Requirements vulnerability in juniper networks ctp os. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.2% of scored vulnerabilities.
Timeline
- 09-04-2026PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access. This issue affects CTP OS versions 9.2R1 and 9.2R2.
CVSS metrics
4 scores · 2 sources · 2 versions- NVDNIST9.1CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
+0.12 pp
From 0.26% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Juniper1 product
- ctp_operating_system9.2:r1 | 9.2:r2
Juniper networks1 product
- ctp os≥ 9.2R1, ≤ 9.2R2
2 vendors · 2 products
References
1 links- kb.juniper.net/JSA107864Vendor Advisory