Weakness (CWE)
CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
How to prevent it (4 mitigations)
-
Architecture and Design
A product's design should require adherence to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:
- Enforcement of a minimum and maximum length
- Restrictions against password reuse
- Restrictions against using common passwords
- Restrictions against using contextual string in the password (e.g., user id, app name)
Depending on the threat model, the password policy may include several additional attributes.
- Complex passwords requiring mixed character sets (alpha, numeric, special, mixed case)
- Increasing the range of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- Unfortunately, a complex password may be difficult to memorize, encouraging a user to select a short password or to incorrectly manage the password (write it down).
- Another disadvantage of this approach is that it often does not result in a significant increase in overall password complexity due to people's predictable usage of various symbols.
- Large Minimum Length (encouraging passphrases instead of passwords)
- Increasing the number of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- A disadvantage of this approach is that selecting a good passphrase is not easy and poor passwords can still be generated. Some prompting may be needed to encourage long un-predictable passwords.
- Randomly Chosen Secrets
- Generating a password for the user can help make sure that length and complexity requirements are met, and can result in secure passwords being used.
- A disadvantage of this approach is that the resulting password or passphrase may be too difficult to memorize, encouraging them to be written down. However, there is growing adoption of password managers that allow users to manage many passwords with varying complexity requirements.
See NIST 800-63B [REF-1053] for further information on password requirements.
-
Architecture and Design
Consider a second
authentication factor beyond the password, which prevents the
password from being a single point of failure. See CWE-308 for
further information. -
Implementation
Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
-
Implementation
Previously, "password expiration" was
widely advocated as a defense-in-depth approach to
minimize the risk of weak passwords, and it has become
a common practice. Password expiration requires a
password to be changed within a fixed time window (such
as every 90 days). However, this approach has
significant limitations in the current threat
landscape, and its utility has been reduced in light of
the adoption of related protection mechanisms (such as
password complexity and computational effort), along
with the recognition that regular password changes
often caused users to generate more predictable
passwords. As a result, this is now a Discouraged
Common Practice [REF-1488] [REF-1489], especially as
the sole factor in protecting passwords. It is still
strongly encouraged to force password changes in case
of evidence of compromise, but this is not the same as
a forced "expiration" on an arbitrary time
frame.
Source: MITRE CWE-521
168 results · Feed
-
High 7.5
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through …
-
Low 3.7
Webkul Aureus ERP UserForm.php weak password
A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak pas…
-
Critical 9.5
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate…
-
High 8.1
Credential Manager Vulnerability Allows Unauthorized Administrative Access
A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator…
-
High 8.8
SMP security request
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
-
High 8.4
Loytec LINX firmware: Improper Authentication in PAM configuration
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root sh…
-
Low 3.1
HCL MyCloud affected by Weak Password Policy
HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.
-
Medium 6.9
Weak Password Requirements in KTM System e-BOK
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.
-
Medium 5.0
Tenda AC15 Samba smb.conf weak password
A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the …
-
Medium 5.9
IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong pas…
-
Low 3.1
Besen BS20 EV Charging Station Bluetooth Low Energy weak password
A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements. The attack needs to be done withi…
-
High 7.6
Weak Password Policy Vulnerability in Quantum Networks Router QN-I-470
This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force …
-
Critical 9.1
Horner Automation Cscape and XL4, XL7 PLC Weak password requirements
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.
-
High 7.4
CTP OS: Configuring password requirements does not work which permits the use of weak passwords
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The p…
-
Medium 4.8
OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation
OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttl…
-
Medium 4.8
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting att…
-
Medium 4.8
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook…
-
Low 2.7
Nautobot: Management of users via REST API does not apply configured password validators
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATORS setting (which def…
-
Medium 4.2
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.
-
Critical 9.1
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after…
-
Critical 9.8
Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively …
-
Low 2.0
Beetel 777VR1 UART weak password
A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing a manipulation can lead to weak password requirements. The physical device can be targeted for the a…
-
Low 3.1
HCL AION is affected by a Weak Password Policy vulnerability
HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access
-
Medium 5.7
Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may a…
-
High 8.4
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The ro…
-
High 8.5
Apache Fineract: weak password policy
Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users are encouraged to upgrade to version 1.13.0, the latest release.
-
Medium 6.9
FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app…
-
Critical 9.8
An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible o…
-
Low 3.7
LibreNMS has Weak Password Policy
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrat…
-
High 7.5
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty …
-
Critical 9.8
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immedi…
-
High 8.2
General Industrial Controls Lynx+ Gateway Weak Password Requirements
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
-
Medium 6.9
Insufficient Password Policy
Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
High 8.1
MLflow Weak Password Requirements Authentication Bypass Vulnerability
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exi…
-
Critical 10.0
Weak Password Policy
Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
High 8.3
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexi…
-
Low 3.7
Mangati NovoSGA User Creation new weak password
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password …
-
Medium 5.9
IBM Transformation Extender Advanced information disclosure
IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
-
High 8.6
Weak Authentication for Root User
No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
-
High 8.0
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credent…