Weakness (CWE)
CWE-1393: Use of Default Password
The product uses default passwords for potentially critical functionality.
How to prevent it (4 mitigations)
-
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
-
Documentation
Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
-
Architecture and Design
Force the administrator to change the credential upon installation.
-
Installation, Operation
The product administrator could change the defaults upon installation or during operation.
Source: MITRE CWE-1393
9 results · Clear filters · Feed
-
High 8.1
Default Administrator Password Change Not Enforced in Axxon One Web Client
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because th…
-
High 8.1
Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers…
-
High 7.7
Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
-
High 8.8
70mai A510 Use of Default Password Authentication Bypass Vulnerability
70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability. The sp…
-
High 7.3
ZKTeco BioTime default password
ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").
-
High 8.8
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Passwor…
-
High 8.3
Plaintext default credentials in firmware
After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers. This issue affects Iocharger firmware for AC models before firmware ver…
-
High 7.5
IBM Storage Virtualize information disclosure
IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.
-
High 8.1
Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be uti…