Weakness (CWE)
CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
How to prevent it (4 mitigations)
-
Architecture and Design
A product's design should require adherence to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:
- Enforcement of a minimum and maximum length
- Restrictions against password reuse
- Restrictions against using common passwords
- Restrictions against using contextual string in the password (e.g., user id, app name)
Depending on the threat model, the password policy may include several additional attributes.
- Complex passwords requiring mixed character sets (alpha, numeric, special, mixed case)
- Increasing the range of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- Unfortunately, a complex password may be difficult to memorize, encouraging a user to select a short password or to incorrectly manage the password (write it down).
- Another disadvantage of this approach is that it often does not result in a significant increase in overall password complexity due to people's predictable usage of various symbols.
- Large Minimum Length (encouraging passphrases instead of passwords)
- Increasing the number of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- A disadvantage of this approach is that selecting a good passphrase is not easy and poor passwords can still be generated. Some prompting may be needed to encourage long un-predictable passwords.
- Randomly Chosen Secrets
- Generating a password for the user can help make sure that length and complexity requirements are met, and can result in secure passwords being used.
- A disadvantage of this approach is that the resulting password or passphrase may be too difficult to memorize, encouraging them to be written down. However, there is growing adoption of password managers that allow users to manage many passwords with varying complexity requirements.
See NIST 800-63B [REF-1053] for further information on password requirements.
-
Architecture and Design
Consider a second
authentication factor beyond the password, which prevents the
password from being a single point of failure. See CWE-308 for
further information. -
Implementation
Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
-
Implementation
Previously, "password expiration" was
widely advocated as a defense-in-depth approach to
minimize the risk of weak passwords, and it has become
a common practice. Password expiration requires a
password to be changed within a fixed time window (such
as every 90 days). However, this approach has
significant limitations in the current threat
landscape, and its utility has been reduced in light of
the adoption of related protection mechanisms (such as
password complexity and computational effort), along
with the recognition that regular password changes
often caused users to generate more predictable
passwords. As a result, this is now a Discouraged
Common Practice [REF-1488] [REF-1489], especially as
the sole factor in protecting passwords. It is still
strongly encouraged to force password changes in case
of evidence of compromise, but this is not the same as
a forced "expiration" on an arbitrary time
frame.
Source: MITRE CWE-521
35 results · Clear filters · Feed
-
Critical 9.5
MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials
MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakePHP's FormAuthenticate…
-
Critical 9.1
Horner Automation Cscape and XL4, XL7 PLC Weak password requirements
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.
-
Critical 9.1
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after…
-
Critical 9.8
Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements
The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively …
-
Critical 9.8
An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible o…
-
Critical 9.8
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immedi…
-
Critical 10.0
Weak Password Policy
Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
-
Critical 9.4
VaulTLS has a password-based login exploit in additional user accounts
VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that…
-
Critical 9.8
An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or …
-
Critical 9.8
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
-
Critical 9.8
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits …
-
Critical 9.1
An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.
-
Critical 9.8
Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited,…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password …
-
Critical 9.4CVE-2024-48845 Public exploit
Weak Password Rules/Strength
Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v3.07.02; MATRIX Ser…
-
Critical 9.8CVE-2024-42850 Public exploit
Silverpeas vulnerable to password complexity rule bypass
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
-
Critical 9.8
Improper authentication in YMS VIS Pro
YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and enumerated through bru…
-
Critical 9.8
In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain inst…
-
Critical 9.8
An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirem…
-
Critical 9.8
Apache InLong: Weak Password Implementation in InLong
Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess …
-
Critical 9.8
A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device w…
-
Critical 9.8
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
-
Critical 9.8
Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthentica…
-
Critical 9.8
Weak Password Requirements in ikus060/minarca
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2.
-
Critical 9.8
Raneto v0.17.0 employs weak password complexity requirements
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
-
Critical 9.8
BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-f…
-
Critical 9.8
Secheron SEPCOS Control and Protection Relay
Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
-
Critical 9.6
ICSA-22-104-03 Red Lion DA50N
The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default en…
-
Critical 9.0
Weak default credential associated with TCP port 26
Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior to R15A. Hitachi En…
-
Critical 9.8
InHand Networks IR615 Router
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and perform operations …
-
Critical 9.8
ECOA BAS controller - Weak Password Requirements
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
-
Critical 9.8
MOXA NPort IAW5000A-I/O Series
The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.
-
Critical 9.8CVE-2019-17444 EPSS 69%
JFrog Artifactory does not enforce default admin password change
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Ar…
-
Critical 9.8
Weak Password Requirements in UnboundID LDAP SDK
UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindR…
-
Critical 9.8
A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-log…