Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1393: Use of Default Password

Base Incomplete

The product uses default passwords for potentially critical functionality.

How to prevent it (4 mitigations)

  1. Requirements

    Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

  2. Documentation

    Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.

  3. Architecture and Design

    Force the administrator to change the credential upon installation.

  4. Installation, Operation

    The product administrator could change the defaults upon installation or during operation.

Source: MITRE CWE-1393

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-112030

    diem-project diem dmDataLoad.php default password

    A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remote…

    diem-project diem
  • Medium 5.3
    CVE-2026-16755

    A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that …

    Lenovo Smart Camera C33 Pro Smart Camera C5X Smart Camera RQ3
  • Medium 5.3
    CVE-2026-82698

    sambitraj Student-Management-System aca.sql default password

    A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the file aca.sql. Performing a manipulation results in use of default password. Remote exploitation of the …

    sambitraj Student-Management-System
  • Medium 6.9
    CVE-2026-54445

    Vantage6: Set admin user and password from environment or configuration

    vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with use…

    vantage6 vantage6 vantage6 PyPI
  • Medium 5.1
    CVE-2026-8672

    Default credentials for internal DB

    Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0.

    syslink software Avantra
  • Medium 6.7
    CVE-2025-14917

    IBM WebSphere Application Server Liberty could provide weaker than expected security

    IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.

    IBM WebSphere Application Server - Liberty
  • Medium 6.3
    CVE-2026-3186

    feiyuchuixue sz-boot-parent Password Reset password default password

    A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unknown functionality of the file /api/admin/sys-user/reset/password/ of the component Password Reset Handler. This manipulation of the argume…

    feiyuchuixue sz-boot-parent
  • Medium 6.9
    CVE-2025-43799

    Liferay Portal Uses Default Password

    Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user h…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.9
    CVE-2025-43021

    Poly Clariti Manager - Multiple Security Vulnerabilities

    A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vulnerability could allow the use and retrieval of the default password. HP has addressed the issue in the latest software update.

    HP Poly Clariti Manager
  • Medium 6.4
    CVE-2025-2921

    Netis WF-2404 passwd default password

    A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. Affected is an unknown function of the file /etc/passwd. The manipulation with the input Realtek leads to use of default password. It is possible to launch the attack on the phy…

    Netis WF-2404
  • Medium 6.3
    CVE-2025-2347

    IROAD Dash Cam FX2 Device Registration default password

    A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of …

    IROAD Dash Cam FX2
  • Medium 6.6
    CVE-2024-48987

    Snipe-IT remote code execution

    Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

    snipe/snipe-it Packagist
  • Medium 6.8
    CVE-2024-36440

    An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may…