Initialization of a Resource with an Insecure Default
CWE-1188
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
We track 169 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.7. 5 have been exploited in real attacks.
Latest Initialization of a Resource with an Insecure Default vulnerabilities
- 9.8 Critical severity
Apache Solr: Use of Hard-coded Credentials
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials instal
- 8.6 High severity
C6: Initialization of a Resource with an Insecure Default
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the chargin
- 7.5 High severity
phpMyFAQ: Initialization of a Resource with an Insecure Default
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validatio
- 7.5 High severity
algernon: Generation of Error Message Containing Sensitive Information
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled. debugMode activates the PrettyError renderer, whic
- 9.4 Critical severity
siyuan: Improper Neutralization of Input During Web Page Generation
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape, then a render template uses raw strings.ReplaceAll(tpl, "${avName}", nodeAvName) to embed the name in
- 9.4 Critical severity
siyuan: Improper Neutralization of Input During Web Page Generation
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and passes it through decodeURIComponent before assigning to messageElement.innerHTML in a
- 7.4 High severity
Grafana OSS: Initialization of a Resource with an Insecure Default
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses specifying a mask explicitly are not affected; to mitigate easily, add the desired mask (usually /128) to the addresses. Only auth proxy is affected; Okta, SAML,
- 8.8 High severity
antSword: Improper Neutralization of Input During Web Page Generation
AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.
- 9.1 Critical severity
Pandora FMS: Initialization of a Resource with an Insecure Default
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800
- 7.5 High severity
EcoStruxure™ Panel Server: Initialization of a Resource with an Insecure Default
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using
- 7.7 High severity
SIMATIC HMI MTP1000 Unified Comfort Panel: Initialization of a Resource with an Insecure Default
Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling
- 8.2 High severity
new-api: Insufficient Verification of Data Authenticity
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit a
- 7.3 High severity
PraisonAI: Missing Authentication for Critical Functionality
PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the c
- 9.8 Critical severity
OpenClaw: Initialization of a Resource with an Insecure Default
OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead
- 9.6 Critical severity
OpenClaw: Initialization of a Resource with an Insecure Default
OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting t
- 7.2 High severity
BigFix Service Management (SM): Initialization of a Resource with an Insecure Default
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow unintended modifications to critical system components, potentially increasing the risk of system compromise o
- 7.7 High severity
OpenClaw: Server-Side Request Forgery
OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through brows
- 9.8 Critical severity
FileStore: Initialization of a Resource with an Insecure Default
BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers
- 8.8 High severity
Helix Core Server (P4D): Initialization of a Resource with an Insecure Default
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password se
- 10.0 Critical severity
paperclip: Improper Authentication
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authent
- 7.5 High severity
SD-330AC: Initialization of a Resource with an Insecure Default
Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial (factory-default) configuration, the device can be c
- 9.8 Critical severity
OpenPLC_V3: Initialization of a Resource with an Insecure Default
OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API.
- 9.9 Critical severity
budibase: Server-Side Request Forgery
Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protection mechanism (IP blacklist) is rendered completely ineffective
- 8.1 High severity
go-sdk: Initialization of a Resource with an Insecure Default
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authenticatio
- 9.4 Critical severity
Jetson Xavier Series and Jetson Orin Series: Initialization of a Resource with an Insecure Default
NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information di
- 9.8 Critical severity
OpenClaw: Initialization of a Resource with an Insecure Default
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS-
- 7.5 High severity
FileRise: Use of Hard-coded Credentials
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tok
- 8.1 High severity
AVideo: Initialization of a Resource with an Insecure Default
WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to "password", which is automatically used to seed the admin account during instal
- 7.5 High severity
anything-llm: Permissive Cross-domain Security Policy with Untrusted Domains
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSo
- 10.0 Critical severity
himmelblau: Initialization of a Resource with an Insecure Default
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if Himmelblau is deployed without a configured tenant domain in himmelblau.conf, authentication is not tenant-scoped. In this mode, Himmelblau can acce
- 9.8 Critical severity
SFX2100 Series SuperFlex SatelliteReceiver: Initialization of a Resource with an Insecure Default
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the `private` SNMP community string with read/wr
- 9.8 Critical severity
810 Firmware: Initialization of a Resource with an Insecure Default
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a crafted script.
- 8.8 High severity
777VR1: Initialization of a Resource with an Insecure Default
A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local ne
- 9.8 Critical severity
FUXA: Use of Hard-coded Cryptographic Key
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through ver
- 7.5 High severity
terraform-provider-proxmox: Improper Limitation of a Pathname to a Restricted Directory
Terraform / OpenTofu Provider adds support for Proxmox Virtual Environment. Prior to version 0.93.1, in the SSH configuration documentation, the sudoer line suggested is insecure and can result in escaping the folder using ../, allowing any files on the system
- 9.3 Critical severity
Fuxa: Initialization of a Resource with an Insecure Default
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote att
- 9.3 Critical severity
Access Manager 92xx-k5: Missing Authentication for Critical Functionality
The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is
- 9.3 Critical severity
Kaba exos 9300: Missing Authentication for Critical Functionality
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the
- 9.8 Critical severity
harvester: Initialization of a Resource with an Insecure Default
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is no
- 7.8 High severity
Android: Initialization of a Resource with an Insecure Default
In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed