Weakness (CWE)
CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
How to prevent it (4 mitigations)
-
Architecture and Design
A product's design should require adherence to an appropriate password policy. Specific password requirements depend strongly on contextual factors, but it is recommended to contain the following attributes:
- Enforcement of a minimum and maximum length
- Restrictions against password reuse
- Restrictions against using common passwords
- Restrictions against using contextual string in the password (e.g., user id, app name)
Depending on the threat model, the password policy may include several additional attributes.
- Complex passwords requiring mixed character sets (alpha, numeric, special, mixed case)
- Increasing the range of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- Unfortunately, a complex password may be difficult to memorize, encouraging a user to select a short password or to incorrectly manage the password (write it down).
- Another disadvantage of this approach is that it often does not result in a significant increase in overall password complexity due to people's predictable usage of various symbols.
- Large Minimum Length (encouraging passphrases instead of passwords)
- Increasing the number of characters makes the password harder to crack and may be appropriate for systems relying on single factor authentication.
- A disadvantage of this approach is that selecting a good passphrase is not easy and poor passwords can still be generated. Some prompting may be needed to encourage long un-predictable passwords.
- Randomly Chosen Secrets
- Generating a password for the user can help make sure that length and complexity requirements are met, and can result in secure passwords being used.
- A disadvantage of this approach is that the resulting password or passphrase may be too difficult to memorize, encouraging them to be written down. However, there is growing adoption of password managers that allow users to manage many passwords with varying complexity requirements.
See NIST 800-63B [REF-1053] for further information on password requirements.
-
Architecture and Design
Consider a second
authentication factor beyond the password, which prevents the
password from being a single point of failure. See CWE-308 for
further information. -
Implementation
Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
-
Implementation
Previously, "password expiration" was
widely advocated as a defense-in-depth approach to
minimize the risk of weak passwords, and it has become
a common practice. Password expiration requires a
password to be changed within a fixed time window (such
as every 90 days). However, this approach has
significant limitations in the current threat
landscape, and its utility has been reduced in light of
the adoption of related protection mechanisms (such as
password complexity and computational effort), along
with the recognition that regular password changes
often caused users to generate more predictable
passwords. As a result, this is now a Discouraged
Common Practice [REF-1488] [REF-1489], especially as
the sole factor in protecting passwords. It is still
strongly encouraged to force password changes in case
of evidence of compromise, but this is not the same as
a forced "expiration" on an arbitrary time
frame.
Source: MITRE CWE-521
51 results · Clear filters · Feed
-
High 7.5
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through …
-
High 8.1
Credential Manager Vulnerability Allows Unauthorized Administrative Access
A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state before any administrator…
-
High 8.8
SMP security request
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
-
High 8.4
Loytec LINX firmware: Improper Authentication in PAM configuration
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root sh…
-
High 7.6
Weak Password Policy Vulnerability in Quantum Networks Router QN-I-470
This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force …
-
High 7.4
CTP OS: Configuring password requirements does not work which permits the use of weak passwords
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device. The p…
-
High 8.4
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The ro…
-
High 8.5
Apache Fineract: weak password policy
Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users are encouraged to upgrade to version 1.13.0, the latest release.
-
High 7.5
The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty …
-
High 8.2
General Industrial Controls Lynx+ Gateway Weak Password Requirements
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
-
High 8.1
MLflow Weak Password Requirements Authentication Bypass Vulnerability
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exi…
-
High 8.3
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexi…
-
High 8.6
Weak Authentication for Root User
No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
-
High 8.0
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credent…
-
High 8.7
Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read
Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerabil…
-
High 7.4
CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length
BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.
-
High 7.1CVE-2025-25749 Public exploit
An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of p…
-
High 7.5
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the …
-
High 8.8
D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly…
-
High 7.5
Password policy for new users is not strong enough
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
-
High 7.5
CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.
-
High 7.4
Possible Improper authentication Vulnerability in OpenText eDirectory
Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000.
-
High 8.0
A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate p…
-
High 7.5
IBM Common Licensing information disclosure
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895.
-
High 7.2
Weak Password Requirements in Kiloview P1/P2 devices
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
-
High 8.1
An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to d…
-
High 8.8
Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (…
-
High 8.8
Chunghwa Telecom NOKIA G-040W-Q - Weak Password Requirements
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing…
-
High 8.6
Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server
There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.
-
High 8.8
Weak Password Requirements in answerdev/answer
Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0.
-
High 7.5
PiiGAB M-Bus Weak Password Requirements
There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.
-
High 7.5
Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module …
-
High 7.5
EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional p…
-
High 7.5
Electra Central AC unit – Easily calculated password
Electra Central AC unit – The unit opens an AP with an easily calculated password.
-
High 7.3
Weak Password Requirements in janeczku/calibre-web
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
-
High 7.5
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sens…
-
High 7.1
Weak Password Requirements in thorsten/phpmyfaq
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
-
High 8.1
Weak Password Requirements in publify/publify
Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
-
High 7.5
A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, build…
-
High 7.2
Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a co…