CVE-2026-33771: CTP OS: Configuring password requirements does not work which permits the use of weak passwords
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device.
The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access.
This issue affects CTP OS versions 9.2R1 and 9.2R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks CTP OSto a version that resolves this vulnerability.Fixed in 9.3R1 - Operational
Verify the fix by using the menu option "Show password requirements" to confirm password complexity requirements are enforced and saved after upgrade.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33771?
CVE-2026-33771 is considered a medium severity vulnerability due to the potential for unauthorized access through weak passwords.
How do I fix CVE-2026-33771?
To fix CVE-2026-33771, it is recommended to enforce strong password policies and update to a secured version of Juniper Networks CTP OS if applicable.
What versions of Juniper Networks CTP OS are affected by CVE-2026-33771?
CVE-2026-33771 affects Juniper Networks CTP OS versions 9.2R1 and 9.2R2.
Who can exploit CVE-2026-33771?
CVE-2026-33771 can be exploited by unauthenticated, network-based attackers due to weak password configurations.
What impact does CVE-2026-33771 have on system security?
CVE-2026-33771 allows attackers to gain unauthorized access to local user accounts, potentially compromising system security.