Weakness (CWE)
CWE-1392: Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
How to prevent it (3 mitigations)
-
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
-
Architecture and Design
Force the administrator to change the credential upon installation.
-
Installation, Operation
The product administrator could change the defaults upon installation or during operation.
Source: MITRE CWE-1392
55 results · Clear filters · Feed
-
Critical 9.8
Airship AI Acropolis default credentials
Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gaining the privileges of …
-
Critical 10.0
CWE-1392: Use of Default Credentials
-
Critical 9.8
Pan-Tilt-Zoom cameras default administrative credentials for web interface
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
-
Critical 9.8
TRENDnet TI-G160i/TI-PG102i/TPL-430AP SSH Service default credentials
A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The e…
-
Critical 9.8
Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.
-
Critical 9.1
Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability.
-
Critical 9.1
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.…
-
Critical 9.8
An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts…
-
Critical 9.8
MOBATIME Network Master Clock has a use of default credentials vulnerability
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.
-
Critical 9.5
Use of default credentials at Traccar fleet management solution
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by t…
-
Critical 9.8
Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There…
-
Critical 9.8
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system st…
-
Critical 9.8
qBittorrent Web UI Default Credentials Lead to RCE
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the d…
-
Critical 10.0
Proscend Advice ICR Series routers fw version 1.76
Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials
-
Critical 9.8
Hitron Technologies Inc. CODA-5310 - Using default credentials
Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the ad…