Weakness (CWE)
CWE-1392: Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
How to prevent it (3 mitigations)
-
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
-
Architecture and Design
Force the administrator to change the credential upon installation.
-
Installation, Operation
The product administrator could change the defaults upon installation or during operation.
Source: MITRE CWE-1392
142 results · Feed
-
High 7.4
Default Credentials in ssh service for SmartPlay in Maruti Suzuki
Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects …
-
High 8.1
IBM Sterling Connect:Direct Web Services information disclosure
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical functionality.
-
High 8.2
Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with lo…
-
High 7.3
Tosei Online Store Management System ネット店舗管理システム Backend default credentials
A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be init…
-
Critical 9.5
Use of default credentials at Traccar fleet management solution
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by t…
-
High 8.6
Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
-
Medium 6.8
Philips Vue PACS Use of Default Credentials
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system…
-
Medium 5.3
Skupper: potential authentication bypass to skupper console via forged cookies
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authe…
-
Medium 5.3
Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network…
-
High 8.8CVE-2024-4007 Public exploit
Hard coded default credential contained in install package
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
-
High 7.4
Hardcoded root password
All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL.
-
High 8.0
Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not aske…
-
High 7.8
NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability
NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. An attacker must f…
-
High 8.3
alpitronic Hypercharger EV Charger Use of Default Credentials
If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator.
-
Critical 9.8
Default credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functions
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There…
-
High 7.4
IOSIX IO-1020 Micro ELD Use of Default Credentials
IO-1020 Micro ELD web server uses a default password for authentication.
-
High 7.4
IOSIX IO-1020 Micro ELD Use of Default Credentials
IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.
-
High 8.8
The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for…
-
Critical 9.8
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system st…
-
Critical 9.8
qBittorrent Web UI Default Credentials Lead to RCE
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the d…
-
Critical 10.0
Proscend Advice ICR Series routers fw version 1.76
Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials
-
Critical 9.8
Hitron Technologies Inc. CODA-5310 - Using default credentials
Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the ad…