Weakness (CWE)
CWE-1393: Use of Default Password
The product uses default passwords for potentially critical functionality.
How to prevent it (4 mitigations)
-
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
-
Documentation
Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
-
Architecture and Design
Force the administrator to change the credential upon installation.
-
Installation, Operation
The product administrator could change the defaults upon installation or during operation.
Source: MITRE CWE-1393
50 results · Feed
-
High 8.1
Default Administrator Password Change Not Enforced in Axxon One Web Client
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because th…
-
High 8.1
Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers…
-
Medium 6.3
diem-project diem dmDataLoad.php default password
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remote…
-
Medium 5.3
A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that …
-
Critical 9.8
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in…
-
Medium 5.3
sambitraj Student-Management-System aca.sql default password
A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the file aca.sql. Performing a manipulation results in use of default password. Remote exploitation of the …
-
High 7.7
Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
-
Critical 9.8
VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
-
Critical 9.1
VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a…
-
Critical 9.8
Navigator NCS and MCP System Accounts with Default Passwords
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limit…
-
Medium 6.9
Vantage6: Set admin user and password from environment or configuration
vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with use…
-
Critical 9.8
Hardcoded default Password for Service Account
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
-
Medium 5.1
Default credentials for internal DB
Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0.
-
Critical 9.8
JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial passwor…
-
Medium 6.7
IBM WebSphere Application Server Liberty could provide weaker than expected security
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
-
Critical 9.4
Use of hard coded credentials in GoHarbor Harbor
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
-
Critical 9.8
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the produc…
-
Medium 6.3
feiyuchuixue sz-boot-parent Password Reset password default password
A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argume…
-
Critical 9.8
MLflow Use of Default Password Authentication Bypass Vulnerability
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists…
-
Critical 9.3
Tenda W30E V2 Hardcoded Default Password for Built-in Account
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these defaul…
-
Critical 9.3
No password set for administrative account in Vivotek IP7137 cameras
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to t…
-
Critical 9.8
NeuVector admin account has insecure default password
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access withi…
-
Medium 6.9
Liferay Portal Uses Default Password
Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user h…
-
Low 2.5
Cudy WR1200EA shadow default password
A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. Affected is an unknown function of the file /etc/shadow. Executing manipulation can lead to use of default password. The attack needs to be launched locally. A high complexity level is ass…
-
Medium 5.9
Poly Clariti Manager - Multiple Security Vulnerabilities
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update.
-
High 8.8
70mai A510 Use of Default Password Authentication Bypass Vulnerability
70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability. The sp…
-
High 7.3
ZKTeco BioTime default password
ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").
-
Critical 9.8
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthen…
-
Critical 9.8
Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.
-
Medium 6.4
Netis WF-2404 passwd default password
A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the phy…
-
High 8.8
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Passwor…
-
Medium 6.3
IROAD Dash Cam FX2 Device Registration default password
A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of …
-
Critical 10.0
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lea…
-
Low 3.1
i-Drive i11/i12 WiFi default password
A vulnerability has been found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This vulnerability affects unknown code of the component WiFi. The manipulation leads to use of default password. Access to the local network is required for t…
-
Critical 10.0
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with defau…
-
High 8.3
Plaintext default credentials in firmware
After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers. This issue affects Iocharger firmware for AC models before firmware ver…
-
Critical 10.0
Force Change of Default Credentials
Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series…
-
Critical 9.8
Unprotected Exposed Firebird Database with default credentials
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other s…
-
Medium 6.6
Snipe-IT remote code execution
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.
-
Medium 6.8
An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may…