CWE-521: Weak Password Requirements, page 4
Filter
The product does not require that users should have strong passwords.
What the weakness is: CWE-521 at MITRE. OWASP Top 10: A07:2025 Authentication Failures
Related attack patterns (CAPEC): 9
- CAPEC-16 Dictionary-based Password Attack Likelihood: Medium · Severity: High
- CAPEC-49 Password Brute Forcing Likelihood: Medium · Severity: High
- CAPEC-55 Rainbow Table Password Cracking Likelihood: Medium · Severity: Medium
- CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
- CAPEC-112 Brute Force Severity: High
- CAPEC-509 Kerberoasting Severity: High
- CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
- CAPEC-561 Windows Admin Shares with Stolen Credentials
- CAPEC-565 Password Spraying Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-521, as MITRE names them. Credits.
Ask an AI about CWE-521
Show the prompt
Explain CWE-521: Weak Password Requirements and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/521.html and https://cve.bz/cve/cwe/521?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2022-31211EPSS 1.7%
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default.
- 7.5CVE-2022-28377EPSS 1.0%
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary incl…
- 9.8CVE-2022-1668EPSS 2.3%
Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
- 8.8CVE-2022-30325EPSS 0.4%
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 G…
- 9.8CVE-2022-2098EPSS 1.0%
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
- 7.5CVE-2022-29729EPSS 1.5%
Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated attackers via the webUI login page.
- 7.5CVE-2022-29098EPSS 1.1%
Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading to a user account co…
- 9.8CVE-2022-1775EPSS 2.2%
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2.
- 7.5CVE-2022-29700EPSS 1.0%
A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during password verification.
- 9.8CVE-2022-1039EPSS 1.2%
The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of wh…
- 6.5CVE-2022-1236EPSS 0.6%
Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
- 7.5CVE-2021-38935EPSS 1.0%
IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892.
- 7.5CVE-2022-22110EPSS 1.2%
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single char…
- 6.5CVE-2021-41696EPSS 0.9%
An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php.
- 7.5CVE-2021-43471EPSS 1.5%
In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, creating a denial of service vulnerability.
- 9.8CVE-2021-43036EPSS 1.9%
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak.
- 7.5CVE-2021-20470EPSS 1.4%
IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339.
- 7.1CVE-2021-40333EPSS 0.7%
Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access to the Data Communication Network (DCN) routing configuration. This issue affects: Hitachi Energy FOX61x versions prior…
- 9.8CVE-2021-40520EPSS 1.2%
Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.
- 9.8CVE-2021-38462EPSS 1.2%
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 does not enforce an efficient password policy. This may allow an attacker with obtained user credentials to enumerate passwords and impersonate other application users and…
- 9.8CVE-2021-35498EPSS 1.3%
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to e…
- 9.8CVE-2021-41296EPSS 0.9%
ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of the system.
- 6.5CVE-2021-28914EPSS 1.0%
BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration tool, but finally not enforced. This is usable and part of an attack chain to gain SSH root access.
- 7.2CVE-2021-28912EPSS 1.2%
BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the final part of an attack chain to gain SSH root access.
- 9.8CVE-2021-20418EPSS 1.0%
IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196279.
- 4.3CVE-2021-1522EPSS 0.7%
A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own password to a value that does not comply with the strong authentication requirements th…
- 6.5CVE-2021-32753EPSS 0.8%
EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is co…
- 8.1CVE-2021-25923EPSS 1.3%
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can levera…
- 9.8CVE-2021-25839EPSS 1.2%
A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing.
- 9.8CVE-2021-26797EPSS 1.4%
An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administrator through an open Telnet service.
- 8.8CVE-2020-11925EPSS 1.3%
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model.
- 6.7CVE-2020-8296EPSS 0.5%
Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.
- 9.8CVE-2021-25309EPSS 1.4%
The telnet administrator service running on port 650 on Gigaset DX600A v41.00-175 devices does not implement any lockout or throttling functionality. This situation (together with the weak password policy that forces a 4-digit password) al…
- 7.5CVE-2020-25153EPSS 1.6%
The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.
- 9.8CVE-2020-29591EPSS 2.6%
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may allow a remote attacker to achieve root access with a blank pa…
- 9.8CVE-2020-26201EPSS 2.4%
Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admin or root user to the device Operating System via Telnet or…
- 6.7CVE-2020-27587EPSS 0.4%
Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the password.
- 4.4CVE-2020-27585EPSS 0.3%
Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on the settings password.
- 3.3CVE-2020-8956ExploitEPSS 1.2%
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
- 9.8CVE-2019-17444ExploitEPSS 69%
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This is…
- 8.8CVE-2020-15369EPSS 1.0%
Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain t…
- 7.5CVE-2020-26103EPSS 1.3%
In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551).
- 7.5CVE-2019-4698EPSS 0.8%
IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929.
- 5.3CVE-2015-8033EPSS 0.8%
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
- 7.5CVE-2020-15115EPSS 1.3%
etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with lit…
- 7.5CVE-2020-4574EPSS 1.9%
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181.
- 7.5CVE-2020-7519EPSS 1.3%
A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user account.
- 9.8CVE-2020-11624EPSS 1.2%
An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account…
- 7.5CVE-2016-11069EPSS 0.9%
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
- 6.5CVE-2020-7492EPSS 1.2%
A CWE-521: Weak Password Requirements vulnerability exists in the GP-Pro EX V1.00 to V4.09.100 which could cause the discovery of the password when the user is entering the password because it is not masqueraded.