CWE-1392: Use of Default Credentials, page 3
Filter
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
What the weakness is: CWE-1392 at MITRE
Ask an AI about CWE-1392
Show the prompt
Explain CWE-1392: Use of Default Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1392.html and https://cve.bz/cve/cwe/1392?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 1.0CVE-2025-2119EPSS 0.3%
A vulnerability was found in Thinkware Car Dashcam F800 Pro up to 20250226. It has been declared as problematic. This vulnerability affects unknown code of the component Device Registration Handler. The manipulation leads to use of default…
- 7.5CVE-2024-13893EPSS 0.2%
Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI conne…
- 7.6CVE-2024-12013EPSS 0.3%
A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of inte…
- 8.7CVE-2024-54015EPSS 0.6%
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89 (CP300) (All versi…
- 6.9CVE-2025-1160EPSS 0.9%
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads…
- 8.7CVE-2025-23012EPSS 0.4%
Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer mainta…
- 6.9CVE-2025-0482EPSS 0.7%
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to in…
- 7.2CVE-2024-12856EPSS 84%
The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when …
- 8.4CVE-2024-12902EPSS 0.2%
ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could r…
- 8.0CVE-2024-10476EPSS 0.2%
Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and per…
- 9.3CVE-2024-12286EPSS 0.4%
MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials.
- 7.1CVE-2024-45068EPSS 0.3%
Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10…
- 7.4CVE-2024-6245EPSS 0.2%
Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market.…
- 9.8CVE-2024-39747EPSS 0.8%
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 uses default credentials for potentially critical functionality.
- 8.2CVE-2024-39584EPSS 0.2%
Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Secure Boot bypass and arbitrary code execution.
- 6.9CVE-2024-7898EPSS 0.6%
A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. Th…
- 9.5CVE-2024-7746EPSS 0.5%
Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwi…
- 9.8CVE-2024-6788EPSS 0.5%
A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predefined, low-privileged user “user-app” to the default password.
- 5.7CVE-2023-40704EPSS 0.3%
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the da…
- 5.3CVE-2024-6535EPSS 0.5%
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an atta…
- 5.3CVE-2024-5632EPSS 0.2%
Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default password. A user is neither advised to change it during the installation process, nor such a need is des…
- 8.7CVE-2024-4007ExploitEPSS 1.5%
Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.
- 7.4CVE-2024-27158EPSS 0.3%
All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL.
- 8.0CVE-2023-43844EPSS 0.4%
Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credentials after first login. If not changed, attackers can log in to the web interface and gain admini…
- 7.8CVE-2024-5245EPSS 0.6%
NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System…
- 8.3CVE-2024-4622EPSS 0.5%
If misconfigured, alpitronic Hypercharger EV charging devices can expose a web interface protected by authentication. If the default credentials are not changed, an attacker can use public knowledge to access the device as an administra…
- 9.8CVE-2024-29844EPSS 0.6%
Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change…
- 7.4CVE-2024-31069EPSS 0.4%
IO-1020 Micro ELD web server uses a default password for authentication.
- 7.4CVE-2024-30210EPSS 0.3%
IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.
- 8.8CVE-2024-28093EPSS 0.5%
The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account.
- 9.8CVE-2023-49621EPSS 0.6%
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application uses default credential with admin privileges. An attacker could use the credentials to …
- 9.8CVE-2023-30801EPSS 1.2%
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote at…
- 9.8CVE-2023-3703EPSS 0.6%
Proscend Advice ICR Series routers FW version 1.76 - CWE-1392: Use of Default Credentials
- 9.8CVE-2023-30603EPSS 0.8%
Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerabil…