Weak Password Requirements
CWE-521
The product does not require that users should have strong passwords.
We track 81 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Consider a second authentication factor beyond the password, which prevents the password from being a single point of failure. See CWE-308 for further information.
- Implementation: Consider implementing a password complexity meter to inform users when a chosen password meets the required attributes.
Latest Weak Password Requirements vulnerabilities
- 7.2 High severity
P1/P2: Weak Password Requirements
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
- 9.8 Critical severity
VIS Pro: Improper Authentication
YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and enumerated through brut
- 8.8 High severity
sbg6580: Weak Password Requirements
Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last octet.)
- 7.5 High severity
Security Verify Access Appliance: Weak Password Requirements
IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.
- 7.3 High severity
Security Verify Access Appliance: Weak Password Requirements
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account with an empty password
- 7.1 High severity
Bitcoin ATM Douro machines: Weak Password Requirements
Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character pa
- 9.8 Critical severity
Enterprise: Weak Password Requirements
In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is
- 8.1 High severity
Nueva Ecija Engineer Online Portal: Weak Password Requirements
A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It is possible to initiat
- 8.8 High severity
Online Notes Sharing System: Weak Password Requirements
A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiate
- 9.8 Critical severity
ac21000_g6_firmware: Weak Password Requirements
An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management.
- 8.8 High severity
NOKIA G-040W-Q: Weak Password Requirements
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing
- 9.8 Critical severity
I-doit: Weak Password Requirements
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
- 7.5 High severity
SNAP PAC S1: Weak Password Requirements
There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.
- 9.8 Critical severity
M-Bus SoftwarePack: Weak Password Requirements
There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines.
- 7.5 High severity
openshift: Weak Password Requirements
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
- 9.8 Critical severity
CloudExplorer-Lite: Weak Password Requirements
Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite pri
- 7.5 High severity
MELSEC iQ-R Series EtherNet/IP module RJ71EIP91: Weak Password Requirements
Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module v
- 9.8 Critical severity
Apache InLong: Weak Password Requirements
Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess th
- 7.5 High severity
SkyBridge MB-A200, SkyBridge BASIC MB-A130…: Weak Password Requirements
Use of weak credentials exists in Seiko Solutions SkyBridge and SkySpider series, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product. Affected products and versions are as follows: SkyBridge MB-A200 firmware Ver.
- 7.5 High severity
SkyBridge MB-A100/110: Weak Password Requirements
Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product.
- 7.5 High severity
Postgres Advanced Server: Cleartext Storage of Sensitive Information
EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed ve
- 7.5 High severity
Sterling Order Management: Weak Password Requirements
IBM Sterling Order Management 10.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 229698.
- 7.5 High severity
Bofei Dbd+: Weak Password Requirements
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy.
- 9.1 Critical severity
Employee Leaves Management System: Weak Password Requirements
A vulnerability was found in PHPGurukul Employee Leaves Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file changepassword.php. The manipulation of the argument newpassword/confirmp
- 9.8 Critical severity
C-Bus Network Automation Controller, LSS5500NAC: Weak Password Requirements
A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0),
- 8.8 High severity
Kiwi: Weak Password Requirements
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by
- 9.8 Critical severity
Lazy Mouse: Weak Password Requirements
Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute force the PIN and execute arbitrary commands. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- 7.2 High severity
Siyucms: Weak Password Requirements
Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers
- 7.5 High severity
HCL iNotes: Weak Password Requirements
HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
- 8.8 High severity
Tabit: Weak Password Requirements
Tabit - password enumeration. Description: Tabit - password enumeration. The passwords for the Tabit system is a 4 digit OTP. One can resend OTP and try logging in indefinitely. Once again, this is an example of OWASP: API4 - Rate limiting.
- 9.8 Critical severity
Mealie: Weak Password Requirements
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.
- 9.8 Critical severity
Robotic Process Automation: Weak Password Requirements
IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
- 8.8 High severity
Fortinet FortiNAC: Weak Password Requirements
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to acce
- 7.5 High severity
Lvskihp Indoorunit Firmware: Weak Password Requirements
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware,
- 8.8 High severity
Tew-831dr Firmware: Weak Password Requirements
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be gu
- 7.5 High severity
4g Lte Network Extender Firmware: Weak Password Requirements
Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page.
- 7.5 High severity
PowerScale OneFS: Weak Password Requirements
Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading to a user account compromise.
- 7.5 High severity
Zammad: Weak Password Requirements
A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification.
- 9.8 Critical severity
DA50N: Weak Password Requirements
The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default ena
- 7.5 High severity
DaybydayCRM: Weak Password Requirements
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow