CWE-1391 · Authentication
Use of Weak Credentials
56CVEs
SortMost likely exploited
56 CVEs with CWE-1391 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-51978CheckBrother Printers – Authentication Bypass via Default Admin PasswordBrother Industries, Ltd · DCP-J928N-W/B · CVSS 9.8 · 2025-06-25 | 9.8 | 16% | 2025-06-25 |
| CVE-2025-53558CheckZTE ZXHN-F660T/F660A - Default CredentialsZTE Japan. K.K. · ZXHN-F660T · CVSS 8.7 · 2025-07-31 | 8.7 | 1.5% | 2025-07-31 |
| CVE-2026-59105Universal sysadmin credential vulnerability in JumisJumis Pro SIA · Jumis · CVSS 9.8 · 2026-11-06 | 9.8 | 1.4% | 2026-11-06 |
| CVE-2024-40892Firewalla BTLE Weak CredentialsFirewalla · Box Software · CVSS 7.1 · 2024-08-12 | 7.1 | 0.9% | 2024-08-12 |
| CVE-2024-12728A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).Sophos · Sophos Firewall · CVSS 9.8 · 2024-12-19 | 9.8 | 0.9% | 2024-12-19 |
| CVE-2025-6077CVE-2025-6077Partner Software · Partner Web · CVSS 9.8 · 2025-08-02 | 9.8 | 0.7% | 2025-08-02 |
| CVE-2026-113735D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentialsD-Link · DCS-6501LH · CVSS 3.7 · 2026-10-20 | 3.7 | 0.7% | 2026-10-20 |
| CVE-2024-45272MB connect line/Helmholz: Generation of weak passwords vulnerabilityMB connect line · mbCONNECT24 · CVSS 7.5 · 2024-10-15 | 7.5 | 0.6% | 2024-10-15 |
| CVE-2026-35089Use of Weak Credentials in Slican telephone exchangesSlican · IPx · CVSS 8.7 · 2026-05-27 | 8.7 | 0.6% | 2026-05-27 |
| CVE-2022-3010Predictable SSH credentials in Priva TopControl SuitePriva · TopControl Suite - Bacnet · CVSS 7.5 · 2024-01-02 | 7.5 | 0.6% | 2024-01-02 |
| CVE-2022-46738CVE-2022-46738Dataprobe, Inc. · Dataprobe iBoot-PDU FW · CVSS 7.2 · 2023-05-22 | 7.2 | 0.6% | 2023-05-22 |
| CVE-2025-3927CVE-2025-3927Digigram · PYKO-OUT · CVSS 9.8 · 2025-05-02 | 9.8 | 0.6% | 2025-05-02 |
| CVE-2025-52364Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. Th…Tenda · Cp3 Pro Firmware · CVSS 7.5 · 2025-07-09 | 7.5 | 0.6% | 2025-07-09 |
| CVE-2025-67114Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote a…No vendor recorded · CVSS 9.8 · 2026-03-19 | 9.8 | 0.5% | 2026-03-19 |
| CVE-2024-42027The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate time and resources.Rocket.Chat · Mobile · CVSS 6.7 · 2024-10-07 | 6.7 | 0.5% | 2024-10-07 |
| CVE-2023-48257The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vu…Rexroth · Nexo cordless nutrunner NXA015S-36V (0608842001) · CVSS 7.8 · 2024-01-10 | 7.8 | 0.5% | 2024-01-10 |
| CVE-2023-31240Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser accou…Snap One · OvrC Cloud · CVSS 8.3 · 2023-05-22 | 8.3 | 0.5% | 2023-05-22 |
| CVE-2025-35970On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator pas…SEIKO EPSON · Multiple EPSON product · CVSS 7.5 · 2025-08-07 | 7.5 | 0.5% | 2025-08-07 |
| CVE-2025-6523Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergen…Devolutions · Server · CVSS 7.7 · 2025-07-22 | 7.7 | 0.5% | 2025-07-22 |
| CVE-2026-22910The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to th…SICK AG · TDC-X401GL · CVSS 7.5 · 2026-01-15 | 7.5 | 0.5% | 2026-01-15 |
| CVE-2024-45722Ruijie Reyee OS Use of Weak CredentialsRuijie · Reyee OS · CVSS 7.5 · 2024-12-06 | 7.5 | 0.5% | 2024-12-06 |
| CVE-2025-30519Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Weak CredentialsDover Fueling Solutions · ProGauge MagLink LX 4 · CVSS 9.8 · 2025-09-18 | 9.8 | 0.5% | 2025-09-18 |
| CVE-2024-43698Kieback&Peter DDC4000 Series Use of Weak CredentialsKieback&Peter · DDC4040e · CVSS 9.8 · 2024-10-22 | 9.8 | 0.4% | 2024-10-22 |
| CVE-2025-59103Weak Default Passwords for SSH Access in dormakaba access managerdormakaba · Access Manager 92xx-k5 · CVSS 9.2 · 2026-01-26 | 9.2 | 0.4% | 2026-01-26 |
| CVE-2025-59460Unsecure access configurationSICK AG · TLOC100-100 with Firmware <7.1.1 · CVSS 7.5 · 2025-10-27 | 7.5 | 0.4% | 2025-10-27 |
| CVE-2024-32759Johnson Controls Software House C●CURE 9000 installer password strengthJohnson Controls · Software House C•CURE 9000 · CVSS 7.7 · 2024-07-10 | 7.7 | 0.4% | 2024-07-10 |
| CVE-2026-109321Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypassgetgrav · grav-plugin-login-oauth · CVSS 9.1 · 2026-10-12 | 9.1 | 0.4% | 2026-10-12 |
| CVE-2025-32471Reuse of saltSICK AG · SICK FLX3-CPUC200 · CVSS 3.7 · 2025-04-28 | 3.7 | 0.4% | 2025-04-28 |
| CVE-2023-0635Privilege escalation to rootABB Ltd. · ASPECT®-Enterprise · CVSS 7.8 · 2023-06-05 | 7.8 | 0.4% | 2023-06-05 |
| CVE-2024-29071HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.KDDI CORPORATION · HGW BL1500HM · CVSS 8.8 · 2024-03-25 | 8.8 | 0.4% | 2024-03-25 |
| CVE-2024-21865HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.KDDI CORPORATION · HGW BL1500HM · CVSS 6.5 · 2024-03-25 | 6.5 | 0.4% | 2024-03-25 |
| CVE-2026-79679Use of Weak CredentialsB&R Industrial Automation GmbH · mapp Services · CVSS 8.7 · 2026-09-03 | 8.7 | 0.3% | 2026-09-03 |
| CVE-2026-107828Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Loginbanq · jivejdon · CVSS 6.5 · 2026-10-08 | 6.5 | 0.3% | 2026-10-08 |
| CVE-2026-66409DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of…ECOVACS ROBOTICS · DEEBOT PRO M1 · CVSS 5.3 · 2026-08-10 | 5.3 | 0.3% | 2026-08-10 |
| CVE-2026-8076Weak credentials vulnerability in the CashDro 3 web administration panelCashDro · CashDro 3 Administration Panel · CVSS 9.3 · 2026-05-08 | 9.3 | 0.3% | 2026-05-08 |
| CVE-2025-55584TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.Totolink · A3002r Firmware · CVSS 5.3 · 2025-08-18 | 5.3 | 0.3% | 2025-08-18 |
| CVE-2025-1081Bharti Airtel Xstream Fiber WiFi Password weak credentialsBharti Airtel · Xstream Fiber · CVSS 3.1 · 2025-02-06 | 3.1 | 0.3% | 2025-02-06 |
| CVE-2025-6737Securden Unified PAM Shared SSH Key and Cloud InfrastructureSecurden · Unified PAM · CVSS 7.2 · 2025-08-25 | 7.2 | 0.3% | 2025-08-25 |
| CVE-2023-28368TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affect…TP-Link Corporation Limited · T2600G-28SQ · CVSS 5.7 · 2023-04-11 | 5.7 | 0.3% | 2023-04-11 |
| CVE-2026-129139paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentialsitwanger · paicoding · CVSS 8.2 · 2026-11-13 | 8.2 | 0.3% | 2026-11-13 |
| CVE-2026-47325Weak password policy in ProjectsAndPrograms school-management-systemProjectsAndPrograms · school-management-system · CVSS 6.9 · 2026-06-03 | 6.9 | 0.2% | 2026-06-03 |
| CVE-2026-22094Weak root password in EVbee DC 80EVbee · DC 80 · CVSS 9.3 · 2026-09-29 | 9.3 | 0.2% | 2026-09-29 |
| CVE-2025-22936An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information via the Weak default W…No vendor recorded · CVSS 5.7 · 2025-02-06 | 5.7 | 0.2% | 2025-02-06 |
| CVE-2026-57473A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credent…Reolink · Home Hub · CVSS 5.8 · 2026-06-26 | 5.8 | 0.2% | 2026-06-26 |
| CVE-2026-24449For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.ELECOM CO.,LTD. · WRC-X1500GS-B · CVSS 5.1 · 2026-02-03 | 5.1 | 0.2% | 2026-02-03 |
| CVE-2026-66408The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root acc…ECOVACS ROBOTICS · DEEBOT PRO M1 · CVSS 4.6 · 2026-08-10 | 4.6 | 0.2% | 2026-08-10 |
| CVE-2024-5634Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is known, brute-forcing…Longse Technology · LBH30FE200W · CVSS 8.6 · 2024-07-09 | 8.6 | 0.2% | 2024-07-09 |
| CVE-2026-107153Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a cr…Rakuten Mobile, Inc. · Rakuten Mini · CVSS 7 · 2026-10-14 | 7.0 | 0.2% | 2026-10-14 |
| CVE-2025-4057Activemq-artemis-operator: amq broker operator starting credentials reuseRed Hat · AMQ Broker 7.13.0.OPR.1.GA · CVSS 5.5 · 2025-05-26 | 5.5 | 0.2% | 2025-05-26 |
| CVE-2023-3470BIG-IP FIPS HSM password vulnerability CVE-2023-3470F5 · BIG-IP · CVSS 6 · 2023-08-02 | 6.0 | 0.2% | 2023-08-02 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.