cve.bz

CWE-521: Weak Password Requirements, page 2

Filter

The product does not require that users should have strong passwords.

What the weakness is: CWE-521 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 9
  • CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
  • CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
  • CAPEC-55 Rainbow Table Password Cracking Likelihood: Medium · Severity: Medium
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-112 Brute Force Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-565 Password Spraying Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-521, as MITRE names them. Credits.

Ask an AI about CWE-521

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-521: Weak Password Requirements and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/521.html and https://cve.bz/cve/cwe/521?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.8CVE-2024-22330EPSS 0.3%

    IBM Security Verify Governance 10.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

  2. 6.6CVE-2025-48372EPSS 0.3%

    Schule is open-source school management system software. The generateOTP() function generates a 4-digit numeric One-Time Password (OTP). Prior to version 1.0.1, even if a secure random number generator is used, the short length and limited…

  3. 4.3CVE-2025-46742EPSS 0.2%

    Users who were required to change their password could still access system information before changing their password

  4. 6.3CVE-2025-4534EPSS 0.4%

    A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation leads to weak password requirements. The attack may be initiated remotely. The co…

  5. 5.5CVE-2025-1993EPSS 0.1%

    IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flo…

  6. 9.8CVE-2025-28200EPSS 0.7%

    Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.

  7. 7.5CVE-2025-26847EPSS 0.4%

    An issue was discovered in Znuny before 7.1.5. When generating a support bundle, not all passwords are masked.

  8. 8.8CVE-2023-27272EPSS 0.3%

    IBM Aspera Console 3.4.0 through 3.4.4 allows passwords to be reused when a new user logs into the system.

  9. 9.8CVE-2025-25211EPSS 0.9%

    Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, a brute-force attack may allow an attacker unauthorized access and login.

  10. 5.5CVE-2025-1474EPSS 0.4%

    In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally…

  11. 7.1CVE-2025-25749EPSS 0.6%

    An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies.

  12. 9.8CVE-2025-27663EPSS 0.4%

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding OVE-20230524-0007.

  13. 6.5CVE-2024-41778EPSS 0.3%

    IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

  14. 6.3CVE-2025-1341EPSS 1.1%

    A vulnerability, which was classified as problematic, was found in PMWeb 7.2.0. This affects an unknown part of the component Setting Handler. The manipulation leads to weak password requirements. It is possible to initiate the attack remo…

  15. 9.8CVE-2023-37398EPSS 0.3%

    IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

  16. 9.8CVE-2023-35907EPSS 0.3%

    IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

  17. 4.8CVE-2024-42173EPSS 0.2%

    HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to guess or brute-force passwords if the username is known.

  18. 7.5CVE-2025-22390EPSS 0.4%

    An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords …

  19. 9.3CVE-2024-48845ExploitEPSS 1.8%

    Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.  Affected products: ABB ASPECT - Enterprise v3.07.02; NEXUS Se…

  20. 6.5CVE-2024-51398EPSS 0.2%

    Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threatening network security.

  21. 6.5CVE-2024-48272EPSS 0.6%

    D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack.

  22. 8.8CVE-2024-48271EPSS 0.9%

    D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack.

  23. 6.5CVE-2024-22068EPSS 0.2%

    Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: …

  24. 8.8CVE-2024-7293EPSS 0.3%

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.

  25. 6.0CVE-2024-47121EPSS 0.1%

    The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and u…

  26. 6.0CVE-2024-45374EPSS 0.1%

    The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt …

  27. 7.5CVE-2024-47221EPSS 0.4%

    CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.

  28. 6.5CVE-2021-38133EPSS 0.3%

    Possible External Service Interaction attack in eDirectory has been discovered in OpenText™ eDirectory. This impact all version before 9.2.6.0000.

  29. 8.0CVE-2022-39997EPSS 0.3%

    A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges

  30. 9.8CVE-2024-42850EPSS 1.4%

    An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.

  31. 7.5CVE-2024-40697EPSS 0.5%

    IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895.

  32. 6.9CVE-2024-41683EPSS 0.3%

    A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user password…

  33. 7.2CVE-2023-41923EPSS 0.3%

    The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.

  34. 6.2CVE-2024-35137EPSS 0.3%

    IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.

  35. 8.1CVE-2024-36789EPSS 0.4%

    An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security standards.

  36. 9.8CVE-2024-3263EPSS 0.8%

    YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and en…

  37. 2.2CVE-2024-29208EPSS 0.3%

    An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password. Affected Products: UniFi Connect EV Station (Version 1.1.18 and earlier) …

  38. 5.3CVE-2024-32213EPSS 0.9%

    The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords. By default, hard-coded passwords of 10 characters with little or no complexity are allowed.

  39. 6.3CVE-2024-3735EPSS 0.6%

    A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file Main.aspx. The manipulation of the argument New Password/Confirm Password with the input 1 leads t…

  40. 8.8CVE-2024-25729EPSS 0.5%

    Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last octet.)

  41. 5.9CVE-2024-22355EPSS 0.4%

    IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user acc…

  42. 5.1CVE-2023-50305EPSS 0.2%

    IBM Engineering Requirements Management DOORS 9.7.2.7 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 273336.

  43. 5.5CVE-2024-1346EPSS 0.4%

    Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants.

  44. 5.5CVE-2024-1345EPSS 0.2%

    Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password.

  45. 7.5CVE-2023-38369EPSS 0.5%

    IBM Security Access Manager Container 10.0.0.0 through 10.0.6.1 does not require that docker images should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 261196.

  46. 7.3CVE-2023-43016EPSS 0.7%

    IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote user to log into the server due to a user account w…

  47. 7.1CVE-2024-0676EPSS 0.1%

    Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and c…

  48. 3.7CVE-2024-0347EPSS 0.9%

    A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file signup_teacher.php. The manipulation of the argument Password leads to weak passw…

  49. 9.8CVE-2023-49238EPSS 0.8%

    In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon th…

  50. 8.1CVE-2024-0188EPSS 0.7%

    A vulnerability, which was classified as problematic, was found in RRJ Nueva Ecija Engineer Online Portal 1.0. This affects an unknown part of the file change_password_teacher.php. The manipulation leads to weak password requirements. It i…