Use of Default Credentials
CWE-1392
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
We track 99 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Architecture and Design: Force the administrator to change the credential upon installation.
- Installation Operation: The product administrator could change the defaults upon installation or during operation.
Latest Use of Default Credentials vulnerabilities
- 8.4 High severity
iSTAR Ultra: Use of Default Credentials
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑560: Use of Default Credentials. Thi
- 8.1 High severity
XWEB EVO: Use of Hard-coded Credentials
XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credentia
- 9.3 Critical severity
RMM+: Use of Default Credentials
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, incl
- 9.8 Critical severity
Asp.Net-Core-Inventory-Order-Management-System: Use of Default Credentials
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials,
- 8.3 High severity
VIDAA: Improper Restriction of Excessive Authentication Attempts
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate li
- 7.2 High severity
IRISPowerscan: Use of Default Credentials
IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected acco
- 9.8 Critical severity
Etrel INCH: Use of Default Credentials
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default
- 8.4 High severity
Delta UFC500: Use of Default Credentials
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
- 8.7 High severity
Delta UFC500: Use of Default Credentials
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace,
- 7.1 High severity
black_debian_images: Use of Default Credentials
boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use t
- 7.5 High severity
zephyr: Use of Default Credentials
Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openthread/Kconfig.thread). J01NME is the example Joining Device C
- 7.4 High severity
goobi-viewer-core: Improper Authentication
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares
- 9.8 Critical severity
DB-GPT: Use of Default Credentials
DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate
- 9.8 Critical severity
FlyCms: Use of Default Credentials
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solvin
- 9.8 Critical severity
vanus: Use of Default Credentials
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to man
- 9.8 Critical severity
databuff: Use of Default Credentials
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/
- 9.8 Critical severity
JuggleIM: Use of Default Credentials
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin rec
- 7.3 High severity
Amnezia-Web-Panel: Use of Default Credentials
A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remot
- 9.9 Critical severity
astron-agent: Improper Neutralization of Directives in Dynamically Evaluated Code
Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.
- 10.0 Critical severity
P4 (Helix Core): Use of Default Credentials
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary
- 9.8 Critical severity
Logsign SIEM: Use of Default Credentials
Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.
- 9.1 Critical severity
X-SpringBoot: Use of Default Credentials
X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauthenticated attackers can authenticate as any user by submitting the public master code to the emailOrMobileLogin endpoint
- 7.3 High severity
vhr: Use of Default Credentials
A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly ava
- 8.1 High severity
Malcolm: Use of Default Credentials
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regen
- 9.9 Critical severity
Eclipse aeriOS: Exposure of Sensitive Information to an Unauthorized Actor
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed t
- 9.3 Critical severity
Data Management Center: Use of Default Credentials
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
- 8.1 High severity
HIPASE-250: Use of Hard-coded Credentials
A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network ac
- 9.8 Critical severity
LazyOwn: Use of Default Credentials
LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authent
- 9.8 Critical severity
Care Everywhere Gateway: Use of Default Credentials
Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all
- 9.1 Critical severity
SAP Commerce Cloud: Use of Default Credentials
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known creden
- 9.8 Critical severity
API Connect: Use of Default Credentials
IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.
- 9.8 Critical severity
Auto_Bangumi: Use of Default Credentials
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database
- 9.8 Critical severity
C492A-W6 Wi-Fi IP Camera: Use of Default Credentials
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin username with an empty password accepted by the an
- 9.9 Critical severity
openproject: Deserialization of Untrusted Data
OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any
- 7.8 High severity
AIOps: Use of Default Credentials
Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged attacker with console access could potentially exploit this vulnerability to gain Filesystem access. This vulnerability only affects fresh inst
- 8.8 High severity
navify Digital Pathology: Use of Default Credentials
Use of default credentials vulnerability in Roche Diagnostics navify Digital Pathology (RabbitMQ Management interface modules) allows Default Usernames and Passwords. This issue affects navify Digital Pathology: from 2.0.0 before 2.4.1.
- 9.8 Critical severity
rustfs: Use of Hard-coded Credentials
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret() in crates/e
- 7.8 High severity
Operations Analytics - Log Analysis: Use of Default Credentials
IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.
- 7.5 High severity
Cloud Pak for Data System - Cyclops: Use of Default Credentials
IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass auth
- 9.8 Critical severity
TID-L: Use of Default Credentials
Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change the credentials before deployment. TID-L has not been distributed since December 2020, and has not been supported since 2021.