Weakness (CWE)
CWE-1393: Use of Default Password
The product uses default passwords for potentially critical functionality.
How to prevent it (4 mitigations)
-
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
-
Documentation
Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
-
Architecture and Design
Force the administrator to change the credential upon installation.
-
Installation, Operation
The product administrator could change the defaults upon installation or during operation.
Source: MITRE CWE-1393
26 results · Clear filters · Feed
-
Critical 9.8
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in…
-
Critical 9.8
VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
-
Critical 9.1
VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a…
-
Critical 9.8
Navigator NCS and MCP System Accounts with Default Passwords
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limit…
-
Critical 9.8
Hardcoded default Password for Service Account
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
-
Critical 9.8
JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial passwor…
-
Critical 9.4
Use of hard coded credentials in GoHarbor Harbor
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
-
Critical 9.8
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the produc…
-
Critical 9.8
MLflow Use of Default Password Authentication Bypass Vulnerability
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists…
-
Critical 9.3
Tenda W30E V2 Hardcoded Default Password for Built-in Account
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these defaul…
-
Critical 9.3
No password set for administrative account in Vivotek IP7137 cameras
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to t…
-
Critical 9.8
NeuVector admin account has insecure default password
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access withi…
-
Critical 9.8
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthen…
-
Critical 9.8
Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.
-
Critical 10.0
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lea…
-
Critical 10.0CVE-2025-26793 Scanner template
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with defau…
-
Critical 10.0
Force Change of Default Credentials
Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series…
-
Critical 9.8
Unprotected Exposed Firebird Database with default credentials
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other s…
-
Critical 9.8
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastruc…
KEV Jul 29, 2024 -
Critical 9.8
An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html co…
-
Critical 9.1CVE-2024-29021 EPSS 20%
SSRF into Sandbox Escape through Unsafe Default Configuration
Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain uns…
-
Critical 9.8
Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a r…
-
Critical 9.8
An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the de…
-
Critical 9.8
Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials
-
Critical 9.4
Use of default password vulnerability in CyberPower PowerPanel Business
Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business L…
-
Critical 9.6
Use of Default Password
Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.