Juniper Networks CTP OS versions 9.2R1 and 9.2R2 contain a weakness in the password management function where the administrator's configured password complexity requirements are not saved. This results in the system failing to enforce strong password policies, allowing weak passwords to be used for local accounts. An unauthenticated attacker with network access could exploit this by guessing weak passwords to gain unauthorized access and potentially take full control of the affected device. The issue can be verified by using the "Show password requirements" menu option, which reveals that intended complexity settings are not applied.

The vulnerability allows an unauthenticated, network-based attacker to exploit weak password policies on local accounts, potentially leading to unauthorized access with high confidentiality and integrity impact. The attacker could gain full control of the device if weak passwords are used. Availability impact is not indicated. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should manually enforce strong password policies outside of the affected password management menu and monitor for unauthorized access attempts. Avoid using affected versions 9.2R1 and 9.2R2 where possible.