This vulnerability arises from the use of a default password in Juniper Networks JSI vLWC software images. The initial password for a high-privileged account is preset and not required to be changed during setup, enabling unauthorized attackers to access and fully control the device remotely without authentication. The issue affects all versions prior to 3.0.94. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An unauthenticated attacker can gain full administrative access to the affected vLWC device remotely by exploiting the default password. This compromises confidentiality, integrity, and availability of the system, potentially allowing complete device takeover and control over network monitoring or management functions provided by the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to manually change the default password immediately after provisioning if possible and restrict network access to the device to trusted administrators only. Monitor vendor communications for updates on official patches or mitigations.