Use of Default Password
CWE-1393
The product uses default passwords for potentially critical functionality.
We track 32 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.1. 1 has been exploited in real attacks.
How this weakness is prevented
- Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Documentation: Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
- Architecture and Design: Force the administrator to change the credential upon installation.
- Installation Operation: The product administrator could change the defaults upon installation or during operation.
Latest Use of Default Password vulnerabilities
- 7.5 High severity
mbCONNECT24: Use of Default Password
The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality.
- 8.1 High severity
Axxon One: Use of Default Password
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the
- 7.7 High severity
Tuleap Enterprise Edition: Use of Default Password
A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import.
- 9.8 Critical severity
Zulip template: Use of Hard-coded Cryptographic Key
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
- 9.1 Critical severity
Supabase template: Initialization of a Resource with an Insecure Default
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a
- 9.8 Critical severity
Navigator NCS: Use of Default Password
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limite
- 9.8 Critical severity
Single-A: Use of Default Password
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
- 9.8 Critical severity
JSI LWC: Use of Default Password
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password
- 9.8 Critical severity
WebSphere Application Server - Liberty: Use of Default Password
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
- 9.4 Critical severity
Harbor: Use of Hard-coded Credentials
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
- 9.8 Critical severity
Eclipse OpenMQ: Use of Weak Credentials
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first s
- 7.3 High severity
MLflow: Use of Default Password
MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists
- 9.8 Critical severity
W30E V2: Use of Default Password
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default
- 9.8 Critical severity
IP7137: Use of Default Password
Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. While it is possible to set up such a password, a user is not informed about such a need. The vendor has not replied to th
- 9.8 Critical severity
neuvector: Use of Default Password
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within
- 8.8 High severity
A510: Use of Default Password
70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of 70mai A510. Authentication is not required to exploit this vulnerability. The spe
- 7.3 High severity
BioTime: Use of Default Password
ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").
- 9.8 Critical severity
PowerScale OneFS: Use of Default Password
Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to the takeover of a high privileged user account.
- 8.8 High severity
SmartFabric OS10 Software: Use of Default Password
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- 7.8 High severity
Dash Cam FX2: Use of Default Password
A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. This issue affects some unknown processing of the component Device Registration. The manipulation of the argument Password with the input qwertyuiop leads to use of d
- 10.0 Critical severity
Monitoring and Management: Use of Default Password
An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.o
- 9.3 Critical severity
Enterphone MESH: Use of Default Password
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration,
- 8.3 High severity
Iocharger firmware for AC models: Plaintext Storage of a Password
After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers. This issue affects Iocharger firmware for AC models before firmware vers
- 10.0 Critical severity
ASPECT-Enterprise: Use of Default Password
Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not require the installer to change default credentials. Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Series v
- 9.8 Critical severity
Elefant: Unprotected Primary Channel
An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other se
- 9.8 Critical severity
Acronis Cyber Infrastructure (ACI) Insecure Default Password Exploited
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5
- 9.0 Critical severity
judge0: Server-Side Request Forgery
Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escape via Server Side Request Forgery (SSRF). This allows an attacker with sufficient access to the Judge0 API to obtain unsa
- 9.8 Critical severity
cmsv6: Use of Default Password
Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges via the default password component.
- 7.5 High severity
Storage Virtualize: Use of Default Password
IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.
- 9.8 Critical severity
ac21000_g6_firmware: Weak Password Requirements
An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management.
- 9.8 Critical severity
PowerPanel Business Local / Remote: Improper Authentication
Use of default password vulnerability in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Lo
- 9.8 Critical severity
RCCMD: Improper Authentication
Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207.