Use of Default Credentials
CWE-1392
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
We track 99 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Architecture and Design: Force the administrator to change the credential upon installation.
- Installation Operation: The product administrator could change the defaults upon installation or during operation.
Latest Use of Default Credentials vulnerabilities
- 7.3 High severity
native-php-cms: Use of Default Credentials
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack rem
- 7.2 High severity
F3x24: Improper Neutralization of Special Elements used in an OS Command
The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system
- 8.4 High severity
ANCHOR: Use of Default Credentials
ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the
- 8.0 High severity
BD BACTEC™ Blood Culture System: Use of Default Credentials
Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable
- 7.1 High severity
Hitachi Ops Center Common Services: Use of Default Credentials
Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-0
- 7.4 High severity
SmartPlay: Use of Default Credentials
Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects S
- 8.2 High severity
Dell Client Platform BIOS: Use of Default Credentials
Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Secure Boot bypass and arbitrary code execution.
- 9.8 Critical severity
Online Store Management System ネット店舗管理システム: Use of Default Credentials
A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be initi
- 9.8 Critical severity
Server: Improper Authentication
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by th
- 9.8 Critical severity
CHARX SEC-3000: Use of Default Credentials
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
- 9.8 Critical severity
Vue PACS: Use of Default Credentials
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system
- 8.8 High severity
ASPECT Enterprise (ASP-ENT-x): Use of Default Credentials
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
- 8.0 High severity
pe6208_firmware: Use of Default Credentials
Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to the web interface and gain administrator privileges.
- 7.8 High severity
ProSAFE Network Management System: Use of Default Credentials
NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. An attacker must fi
- 8.3 High severity
Hypercharger EV Charger: Use of Default Credentials
If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administrator.
- 9.8 Critical severity
Evolution Controller: Use of Default Credentials
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the password. There
- 9.8 Critical severity
SIMATIC CN 4100: Use of Default Credentials
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to gain complete control
- 9.8 Critical severity
qBittorrent client: Use of Hard-coded Credentials
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the de
- 9.8 Critical severity
Hitron CODA-5310: Use of Default Credentials
Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the adm