CWE-1391: Use of Weak Credentials, page 2

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

What the weakness is: CWE-1391 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

1. 8.0CVE-2024-7558EPSS 0.5%2024-10-02

   JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the J…

2. 7.1CVE-2024-40892EPSS 0.9%2024-08-12

   A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentication and provision SSH credentials over the Bluetooth Low-E…

3. 7.8CVE-2024-42051EPSS 0.2%2024-07-28

   The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg.

4. 7.7CVE-2024-32759EPSS 0.4%2024-07-10

   Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.

5. 8.6CVE-2024-5634EPSS 0.2%2024-07-09

   Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is known, brute-forcing the password becomes relatively easy.  Additionally, every c…

6. 6.5CVE-2024-33849EPSS 0.4%2024-05-28

   ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.

7. 8.8CVE-2024-28066EPSS 0.4%2024-04-08

   In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).

8. 6.5CVE-2024-21865EPSS 0.4%2024-03-25

   HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.

9. 8.8CVE-2024-29071EPSS 0.4%2024-03-25

   HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.

10. 8.8CVE-2023-48257EPSS 0.5%2024-01-10

    The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users…

11. 7.5CVE-2022-3010EPSS 0.6%2024-01-02

    The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.

12. 6.1CVE-2023-3470EPSS 0.2%2023-08-02

    Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.  The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or an…

13. 9.8CVE-2023-0635EPSS 0.4%2023-06-05

    Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules), ABB Ltd. NEXUS Series on NEXUS Series, Linux (2CQG100102R…

14. 9.8CVE-2023-31240EPSS 0.5%2023-05-22

    Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser account accessible through hard-coded credentials.

15. 5.7CVE-2023-28368EPSS 0.3%2023-04-11

    TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator …