Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1393: Use of Default Password

Base Incomplete

The product uses default passwords for potentially critical functionality.

How to prevent it (4 mitigations)

  1. Requirements

    Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

  2. Documentation

    Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.

  3. Architecture and Design

    Force the administrator to change the credential upon installation.

  4. Installation, Operation

    The product administrator could change the defaults upon installation or during operation.

Source: MITRE CWE-1393

All Critical High Medium Low Exploited only Public exploit

50 results · Feed

  • Critical 9.8
    CVE-2023-45249 Exploited Public exploit Scanner template EPSS 54%

    Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastruc…

    Acronis Acronis Cyber Infrastructure
    KEV Jul 29, 2024
  • Critical 9.8
    CVE-2024-30802

    An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html co…

  • Critical 9.1
    CVE-2024-29021 EPSS 20%

    SSRF into Sandbox Escape through Unsafe Default Configuration

    Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain uns…

    judge0 judge0
  • Critical 9.8
    CVE-2024-29666

    Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a r…

  • High 7.5
    CVE-2023-43042

    IBM Storage Virtualize information disclosure

    IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.

    IBM Storage Virtualize
  • Critical 9.8
    CVE-2023-24049

    An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the de…

  • Critical 9.8
    CVE-2023-32090

    Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

    Pega Systems Pega Platform
  • High 8.1
    CVE-2023-28094

    Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be uti…

    Pega Systems Pega Platform
  • Critical 9.4
    CVE-2023-25131

    Use of default password vulnerability in CyberPower PowerPanel Business

    Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business L…

    CyberPower PowerPanel Business Management PowerPanel Business Local / Remote
  • Critical 9.6
    CVE-2022-4126

    Use of Default Password

    Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.

    ABB RCCMD ICS / OT