Initialization of a Resource with an Insecure Default
CWE-1188
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
We track 169 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 8.7. 5 have been exploited in real attacks.
Latest Initialization of a Resource with an Insecure Default vulnerabilities
- 7.3 High severity
Android: Initialization of a Resource with an Insecure Default
In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- 8.1 High severity
python-sdk: Initialization of a Resource with an Insecure Default
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an
- 8.1 High severity
typescript-sdk: Initialization of a Resource with an Insecure Default
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MC
- 9.8 Critical severity
Tooling: Initialization of a Resource with an Insecure Default
Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this cou
- 8.0 High severity
Magic Nx15 Firmware: Weak Password Requirements
H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow f
- 9.8 Critical severity
Fusion: Initialization of a Resource with an Insecure Default
IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform un
- 9.3 Critical severity
1756-EN2T/D: Initialization of a Resource with an Insecure Default
A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and c
- 9.8 Critical severity
issues: Initialization of a Resource with an Insecure Default
HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses an insecure default configuration designed for local development. The default configuration does not
- 7.3 High severity
Tew-wlc100p Firmware: Initialization of a Resource with an Insecure Default
In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks
- 9.8 Critical severity
Director: Initialization of a Resource with an Insecure Default
The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default credentials and multiple accounts (most with sudo access) that utilize the same default credentials. By default, Versa director exposes ssh
- 9.8 Critical severity
CS5000 Fire Panel: Initialization of a Resource with an Insecure Default
The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-le
- 5.3 Medium severity
TeleMessage TM SGNL Initialization of a Resource with an Insecure Default Exploited
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
- 9.8 Critical severity
donetick: Initialization of a Resource with an Insecure Default
Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to
- 8.8 High severity
IEC 1Ph 7.4kW Child socket: Initialization of a Resource with an Insecure Default
A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Parent cable 7m (8EM1310-2EJ04-3GA1) (All versions <
- 7.5 High severity
Bitnami: Initialization of a Resource with an Insecure Default
The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated access to the database inside the cluster. The PGPOOL_SR_CHECK_USER is the user that Pgpool itself use
- 9.8 Critical severity
GX10 / GX20 / GP10 / GP20 Paperless Recorders: Initialization of a Resource with an Insecure Default
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, any
- 8.7 High severity
APROL: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and
- 9.8 Critical severity
WebHMI – Deployed with EcoStruxure Power…: Initialization of a Resource with an Insecure Default
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not disp
- 9.8 Critical severity
QuRouter: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later
- 8.1 High severity
Apache Solr: Initialization of a Resource with an Insecure Default
Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that
- 8.1 High severity
Web Config: Initialization of a Resource with an Insecure Default
Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the informat
- 9.8 Critical severity
FlashArray: Initialization of a Resource with an Insecure Default
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
- 7.5 High severity
Firefox: Initialization of a Resource with an Insecure Default
Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems
- 7.8 High severity
Android: Initialization of a Resource with an Insecure Default
In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileg
- 7.5 High severity
JavaTM Platform: Initialization of a Resource with an Insecure Default
Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. If this vulnerability is exploited, the product may be affected by some known TLS1.0 and TLS1.1 vulnerabilities. As for the specific products/m
- 9.1 Critical severity
FutureNet NXR-1300 series: Initialization of a Resource with an Insecure Default
Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. allows a remote unauthenticated attacker to access telnet service unlimitedly.
- 8.8 High severity
Apache ActiveMQ: Initialization of a Resource with an Insecure Default
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can i
- 10.0 Critical severity
bentoml/bentoml: Initialization of a Resource with an Insecure Default
An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the Be
- 9.8 Critical severity
inattend: Initialization of a Resource with an Insecure Default
A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes to the system configuration, or execution of arbitrary commands within the context of the system.
- 8.3 High severity
OET-213H-BTS1: Initialization of a Resource with an Insecure Default
Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unauthenticated attacker to configure and control the affected product.
- 7.8 High severity
iCLASS SE CP1000 Encoder: Initialization of a Resource with an Insecure Default
Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys.
- 9.8 Critical severity
Unitronics Vision PLC and HMI Insecure Default Password Exploited
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
- 7.8 High severity
SoftEther VPN: Initialization of a Resource with an Insecure Default
An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to unauthorized access. An attacker can send a network request to trigger this vulnera
- 8.8 High severity
Mt Proto Proxy: Initialization of a Resource with an Insecure Default
In the mtproto_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secured default installation without authenticating and achieve remote command execution ability.
- 8.1 High severity
Remote Access Server (RAS): Initialization of a Resource with an Insecure Default
ETIC Telecom RAS versions 4.7.0 and prior the web management portal authentication disabled by default. This could allow an attacker with adjacent network access to alter the configuration of the device or cause a denial-of-service condition.
- 7.8 High severity
Android: Initialization of a Resource with an Insecure Default
In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User inter
- 7.5 High severity
Portal: Initialization of a Resource with an Insecure Default
In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't
- 8.6 High severity
MELSEC WS Series WS0-GETH00200: Initialization of a Resource with an Insecure Default
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it
- 9.8 Critical severity
Apache Superset Insecure Default Initialization of Resource Exploited
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resourc
- 7.8 High severity
Apache OpenOffice: Improper Control of Generation of Code
Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.