cve.bz

CWE-521: Weak Password Requirements

Filter

The product does not require that users should have strong passwords.

What the weakness is: CWE-521 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 9
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-55 Rainbow Table Password Cracking Likelihood: Medium · Severity: Medium
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-112 Brute Force Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-521, as MITRE names them. Credits.

Ask an AI about CWE-521

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-521: Weak Password Requirements and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/521.html and https://cve.bz/cve/cwe/521?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-41021EPSS 0.2%

    Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials.

  2. 2.9CVE-2026-112193EPSS 0.5%

    A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password…

  3. 9.5CVE-2026-85216EPSS 0.9%

    MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user-supplied credentials. The custom LdapAuthenticate and LinOTPAuthenticate components replace CakeP…

  4. 9.8CVE-2026-73778EPSS 0.5%

    A vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker could exploit this vulnerability on a device in its factory-default or post-ZTP state befo…

  5. 8.8CVE-2026-19293EPSS 0.2%

    SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.

  6. 8.4CVE-2026-12504EPSS 0.2%

    Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password …

  7. 6.5CVE-2026-56577EPSS 0.3%

    HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.

  8. 6.9CVE-2026-35097EPSS 0.4%

    KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters. This issue was fixed in the patch published in June 2026.

  9. 1.3CVE-2026-11493EPSS 0.2%

    A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only …

  10. 9.8CVE-2024-40684EPSS 0.4%

    IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users sh…

  11. 1.3CVE-2026-9394EPSS 0.2%

    A vulnerability was determined in Besen BS20 EV Charging Station up to 20260426. This impacts an unknown function of the component Bluetooth Low Energy Handler. Executing a manipulation can lead to weak password requirements. The attack ne…

  12. 7.6CVE-2026-41038EPSS 0.2%

    This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password gues…

  13. 9.3CVE-2026-6284EPSS 0.4%

    An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration…

  14. 9.1CVE-2026-33771EPSS 0.3%

    A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control …

  15. 4.3CVE-2026-34203EPSS 0.3%

    Nautobot is a Network Source of Truth and Network Automation Platform. Prior to versions 2.4.30 and 3.0.10, user creation and editing via the REST API fails to apply the password validation rules defined by Django's AUTH_PASSWORD_VALIDATOR…

  16. 9.8CVE-2025-55269EPSS 0.3%

    HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.

  17. 9.1CVE-2026-27575EPSS 0.5%

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active session…

  18. 9.8CVE-2026-25715EPSS 0.6%

    The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet ser…

  19. 0.3CVE-2026-1408EPSS 0.3%

    A weakness has been identified in Beetel 777VR1 up to 01.00.09/01.00.09_55. This vulnerability affects unknown code of the component UART Interface. Executing a manipulation can lead to weak password requirements. The physical device can b…

  20. 9.8CVE-2025-55252EPSS 0.2%

    HCL AION  version 2 is affected by a Weak Password Policy vulnerability. This can  allow the use of easily guessable passwords, potentially resulting in unauthorized access

  21. 5.3CVE-2025-68963EPSS 0.1%

    Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  22. 8.4CVE-2025-68716EPSS 0.2%

    KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI o…

  23. 8.5CVE-2025-23408EPSS 0.5%

    Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users are encouraged to upgrade to version 1.13.0, the latest release.

  24. 6.9CVE-2025-67513EPSS 0.3%

    FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forc…

  25. 9.8CVE-2025-53963EPSS 0.5%

    An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible over the default port 22. The root account has a weak default password of ionadmin, and a password change policy for the …

  26. 3.7CVE-2025-65014EPSS 0.3%

    LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerabilit…

  27. 7.5CVE-2025-63800EPSS 0.5%

    The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_pass…

  28. 9.8CVE-2025-63747EPSS 0.5%

    QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default conf…

  29. 8.8CVE-2025-55034EPSS 0.3%

    General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.

  30. 6.9CVE-2025-12552EPSS 0.3%

    Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  31. 9.8CVE-2025-11200EPSS 1.4%

    MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. …

  32. 10.0CVE-2025-12364EPSS 0.3%

    Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  33. 10.0CVE-2025-12285EPSS 0.3%

    Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

  34. 8.3CVE-2025-60954EPSS 0.5%

    Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead …

  35. 2.9CVE-2025-11322EPSS 0.4%

    A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can le…

  36. 7.5CVE-2023-49883EPSS 0.3%

    IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

  37. 8.6CVE-2025-9964EPSS 0.2%

    No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).

  38. 8.0CVE-2025-57295EPSS 0.4%

    H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored…

  39. 1.3CVE-2025-10320EPSS 0.2%

    A vulnerability was detected in iteachyou Dreamer CMS up to 4.1.3.2. This issue affects some unknown processing of the file /admin/user/updatePwd. Performing manipulation results in weak password requirements. Remote exploitation of the at…

  40. 6.3CVE-2025-9514EPSS 0.4%

    A vulnerability has been found in macrozheng mall up to 1.0.3. This impacts an unknown function of the component Registration. Such manipulation leads to weak password requirements. The attack can be executed remotely. Attacks of this natu…

  41. 6.8CVE-2025-25737EPSS 0.4%

    Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass auth…

  42. 9.4CVE-2025-55299EPSS 0.2%

    VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This i…

  43. 9.8CVE-2025-30127EPSS 0.5%

    An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings (containing sensitive routes, conversations, and footage) are open for downloadi…

  44. 2.9CVE-2025-8549EPSS 0.5%

    A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak pas…

  45. 5.8CVE-2019-19145EPSS 0.3%

    Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passwords.

  46. 2.9CVE-2025-8182EPSS 0.5%

    A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of the component Samba. The manipulation leads to weak password requirements. The …

  47. 6.5CVE-2025-5022EPSS 0.6%

    Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the un…

  48. 8.7CVE-2025-34058EPSS 0.9%

    Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary …

  49. 7.5CVE-2025-52997EPSS 0.5%

    File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the auth…

  50. 9.8CVE-2025-28389EPSS 0.6%

    Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.