CWE-1392: Use of Default Credentials, page 2
Filter
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
What the weakness is: CWE-1392 at MITRE
Ask an AI about CWE-1392
Show the prompt
Explain CWE-1392: Use of Default Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1392.html and https://cve.bz/cve/cwe/1392?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.3CVE-2026-26366EPSS 0.7%
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these d…
- 8.6CVE-2025-54756EPSS 0.1%
BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device information. The latest release fixes this issue for new installati…
- 5.5CVE-2026-1972EPSS 0.7%
A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument Username/Password results in use of default credentials. The attack may be initiated…
- 8.2CVE-2026-1803EPSS 0.7%
A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the component Dropbear SSH Service. This manipulation causes use of default credentials. Remote exploitation of the attack is possible. The co…
- 8.8CVE-2025-7740EPSS 0.2%
Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment.
- 9.2CVE-2025-59108EPSS 0.4%
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.
- 8.8CVE-2026-22273EPSS 0.4%
Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Use of Default Credentials vulnerability in the OS. A low privileged attacker with remote access could potentially exploit this vulnera…
- 6.9CVE-2025-58744EPSS 0.1%
Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files using credentials decrypted with hard-coded application enc…
- 8.7CVE-2020-36915EPSS 0.4%
Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level …
- 9.3CVE-2022-50803EPSS 0.4%
JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.
- 9.3CVE-2018-25147EPSS 0.4%
Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging …
- 9.3CVE-2021-47707EPSS 0.4%
COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. Attackers can exploit this by sending a POST request with the 'passkey' parameter set to '1234', allowin…
- 9.8CVE-2025-54303EPSS 0.4%
The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ion…
- 9.3CVE-2025-12592EPSS 0.4%
Legacy Vivotek Device firmware uses default credetials for the root and user login accounts.
- 10.0CVE-2025-12218EPSS 0.3%
Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- 6.9CVE-2025-12217EPSS 0.3%
SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
- 9.3CVE-2025-10678EPSS 0.4%
NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect inst…
- 5.5CVE-2025-11943EPSS 0.7%
A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated rem…
- 9.3CVE-2025-34516EPSS 0.6%
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a use of default credentials vulnerability that allows an unauthenticated attacker to obtain remote access. Ilevia has declined to service this vulnerability, and recommends th…
- 9.8CVE-2025-10542EPSS 0.8%
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM …
- 9.3CVE-2025-35042EPSS 0.4%
Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gainin…
- 5.7CVE-2025-55110EPSS 0.1%
Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password.
- 10.0CVE-2025-55051EPSS 0.3%
CWE-1392: Use of Default Credentials
- 9.2CVE-2025-35452EPSS 0.9%
PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface.
- 1.1CVE-2025-9577EPSS 0.2%
A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0. The affected element is an unknown function of the file /etc/shadow.sample of the component Administrative Interface. The manipulation results in use of default credential…
- 1.1CVE-2025-9576EPSS 0.2%
A vulnerability was identified in seeedstudio ReSpeaker LinkIt7688. Impacted is an unknown function of the file /etc/shadow of the component Administrative Interface. The manipulation leads to use of default credentials. An attack has to b…
- 8.7CVE-2025-35114EPSS 0.4%
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgra…
- 5.3CVE-2025-29525EPSS 0.3%
DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel.
- 5.3CVE-2025-29521EPSS 0.6%
Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to escalate privileges via a bruteforce attack.
- 6.5CVE-2025-55740EPSS 0.2%
nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example…
- 5.3CVE-2025-2184EPSS 0.2%
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services…
- 8.9CVE-2025-8731EPSS 0.7%
A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the at…
- 5.5CVE-2025-8530EPSS 0.5%
A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file eladmin-system\src\main\resources\config\application-prod.yml of the compone…
- 9.1CVE-2025-51535EPSS 0.5%
Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability.
- 9.8CVE-2025-51536EPSS 0.6%
Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.
- 9.1CVE-2025-29629EPSS 0.5%
Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for secure shell access. This may result in attackers gaining access to exposed Gar…
- 7.3CVE-2025-54137EPSS 0.4%
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has defa…
- 2.1CVE-2025-7907EPSS 0.5%
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been classified as problematic. Affected is an unknown function of the file ruoyi-admin/src/main/resources/application-druid.yml of the component Druid. The manipulation …
- 7.5CVE-2025-1711EPSS 0.4%
Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.
- 2.1CVE-2025-6951EPSS 0.3%
A vulnerability classified as problematic was found in SAFECAM X300 up to 20250611. This vulnerability affects unknown code of the component FTP Service. The manipulation leads to use of default credentials. Access to the local network is …
- 7.5CVE-2025-52997EPSS 0.5%
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the auth…
- 7.4CVE-2025-6529EPSS 0.9%
A vulnerability was found in 70mai M300 up to 20250611 and classified as critical. Affected by this issue is some unknown functionality of the component Telnet Service. The manipulation leads to use of default credentials. The attack needs…
- 6.5CVE-2024-40113EPSS 0.3%
Sitecom WLX-2006 Wall Mount Range Extender N300 v.1.5 and before is vulnerable to Use of Default Credentials.
- 9.2CVE-2025-5124EPSS 1.0%
A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation lead…
- 6.5CVE-2025-1531EPSS 0.3%
Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0.0-00 before 11.0.4-00.
- 7.8CVE-2025-22460EPSS 0.3%
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges.
- 7.1CVE-2024-46899EPSS 0.3%
Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue affects Hitachi Ops Center Common Services: from 10.0.0-00 before 11.0.0-04; Hitach…
- 9.8CVE-2025-30139EPSS 0.4%
An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam…
- 8.6CVE-2025-2398EPSS 0.6%
A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical. This issue affects some unknown processing of the component CLI su Command Hand…
- 2.3CVE-2025-2341EPSS 0.3%
A vulnerability was found in IROAD Dash Cam X5 up to 20250203. It has been rated as problematic. This issue affects some unknown processing of the component SSID. The manipulation leads to use of default credentials. The attack needs to be…