CWE-1393 · Authentication
Use of Default Password
44CVEs
SortMost likely exploited
44 CVEs with CWE-1393 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-45249In CISA KEVExploitedAcronis Cyber Infrastructure - Default PasswordAcronis · Acronis Cyber Infrastructure · CVSS 9.8 · 2024-07-24 | 9.8 | 54% | 2024-07-24 |
| CVE-2025-26793CheckFREEDOM Administration - Default LoginHirsch · Enterphone MESH · CVSS 10 · 2025-02-15 | 10.0 | 2.4% | 2025-02-15 |
| CVE-2026-2635MLflow Use of Default Password Authentication Bypass VulnerabilityMLflow · MLflow · CVSS 7.3 · 2026-02-20 | 7.3 | 1.1% | 2026-02-20 |
| CVE-2024-48987Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from th…Snipeitapp · Snipe-It · CVSS 6.6 · 2024-10-11 | 6.6 | 1.0% | 2024-10-11 |
| CVE-2023-25131Use of default password vulnerability in CyberPower PowerPanel BusinessCyberPower · PowerPanel Business Local / Remote · CVSS 9.4 · 2023-04-24 | 9.4 | 1.0% | 2023-04-24 |
| CVE-2023-24049An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management.Connectize · Ac21000 G6 Firmware · CVSS 9.8 · 2023-12-04 | 9.8 | 0.9% | 2023-12-04 |
| CVE-2024-29666Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges via the default passwo…No vendor recorded · CVSS 9.8 · 2024-03-25 | 9.8 | 0.7% | 2024-03-25 |
| CVE-2023-43042IBM Storage Virtualize information disclosureIBM · Storage Virtualize · CVSS 7.5 · 2023-12-14 | 7.5 | 0.7% | 2023-12-14 |
| CVE-2024-50588Unprotected Exposed Firebird Database with default credentialsHASOMED · Elefant · CVSS 9.8 · 2024-11-08 | 9.8 | 0.7% | 2024-11-08 |
| CVE-2023-32090Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentialsPegasystems · Pega Platform · CVSS 9.8 · 2023-08-07 | 9.8 | 0.6% | 2023-08-07 |
| CVE-2022-4126Use of Default PasswordABB · RCCMD · CVSS 9.6 · 2023-03-27 | 9.6 | 0.6% | 2023-03-27 |
| CVE-2025-22938Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.Adtran · 411 Firmware · CVSS 9.8 · 2025-03-31 | 9.8 | 0.6% | 2025-03-31 |
| CVE-2025-8077NeuVector admin account has insecure default passwordSUSE · neuvector · CVSS 9.8 · 2025-09-17 | 9.8 | 0.6% | 2025-09-17 |
| CVE-2026-82698sambitraj Student-Management-System aca.sql default passwordsambitraj · Student-Management-System · CVSS 5.3 · 2026-08-31 | 5.3 | 0.5% | 2026-08-31 |
| CVE-2023-28094Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.Pegasystems · Pega Platform · CVSS 8.1 · 2023-06-22 | 8.1 | 0.5% | 2023-06-22 |
| CVE-2026-69657XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.Xing Inc. · XING CPTrans-ME-X · CVSS 9.3 · 2026-09-04 | 9.3 | 0.5% | 2026-09-04 |
| CVE-2024-30802An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component.No vendor recorded · CVSS 9.8 · 2024-05-10 | 9.8 | 0.5% | 2024-05-10 |
| CVE-2025-27690Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker with remote access could potentially exploi…Dell · PowerScale OneFS · CVSS 9.8 · 2025-04-10 | 9.8 | 0.5% | 2025-04-10 |
| CVE-2026-5269Navigator NCS and MCP System Accounts with Default PasswordsCIENA · Navigator NCS · CVSS 9.8 · 2026-07-14 | 9.8 | 0.5% | 2026-07-14 |
| CVE-2026-33784JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged accessJuniper Networks · JSI LWC · CVSS 9.8 · 2026-04-09 | 9.8 | 0.5% | 2026-04-09 |
| CVE-2024-49559Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. A low privileged attacker with remote acces…Dell · SmartFabric OS10 Software · CVSS 8.8 · 2025-03-17 | 8.8 | 0.5% | 2025-03-17 |
| CVE-2026-35075Hardcoded default Password for Service AccountMBS · Single-A · CVSS 9.8 · 2026-06-03 | 9.8 | 0.5% | 2026-06-03 |
| CVE-2025-26701An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exp…Percona · Monitoring and Management · CVSS 10 · 2025-03-11 | 10.0 | 0.5% | 2025-03-11 |
| CVE-2026-22886OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin)…Eclipse Foundation · Eclipse OpenMQ · CVSS 9.8 · 2026-03-03 | 9.8 | 0.5% | 2026-03-03 |
| CVE-2025-14917IBM WebSphere Application Server Liberty could provide weaker than expected securityIBM · WebSphere Application Server - Liberty · CVSS 6.7 · 2026-03-25 | 6.7 | 0.4% | 2026-03-25 |
| CVE-2026-24429Tenda W30E V2 Hardcoded Default Password for Built-in AccountShenzhen Tenda Technology Co., Ltd. · W30E V2 · CVSS 9.3 · 2026-01-26 | 9.3 | 0.4% | 2026-01-26 |
| CVE-2024-51555Force Change of Default CredentialsABB · ASPECT-Enterprise · CVSS 10 · 2024-12-05 | 10.0 | 0.4% | 2024-12-05 |
| CVE-2024-13966ZKTeco BioTime default passwordZKTeco · BioTime · CVSS 7.3 · 2025-05-27 | 7.3 | 0.4% | 2025-05-27 |
| CVE-2025-66050No password set for administrative account in Vivotek IP7137 camerasVivotek · IP7137 · CVSS 9.3 · 2026-01-09 | 9.3 | 0.4% | 2026-01-09 |
| CVE-2026-121022Default Administrator Password Change Not Enforced in Axxon One Web ClientAxxonSoft · Axxon One · CVSS 8.1 · 2026-11-03 | 8.1 | 0.4% | 2026-11-03 |
| CVE-2025-276670mai A510 Use of Default Password Authentication Bypass Vulnerability70mai · A510 · CVSS 8.8 · 2025-06-06 | 8.8 | 0.4% | 2025-06-06 |
| CVE-2025-2921Netis WF-2404 passwd default passwordNetis · WF-2404 · CVSS 6.4 · 2025-03-28 | 6.4 | 0.4% | 2025-03-28 |
| CVE-2026-19851Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5Dassault Systèmes · Tuleap Enterprise Edition · CVSS 7.7 · 2026-08-25 | 7.7 | 0.3% | 2026-08-25 |
| CVE-2026-60044Static backup passwordMB connect line · mbCONNECT24 · CVSS 7.5 · 2026-11-10 | 7.5 | 0.3% | 2026-11-10 |
| CVE-2024-36440An issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administrative device password via password-cra…No vendor recorded · CVSS 6.8 · 2024-08-22 | 6.8 | 0.3% | 2024-08-22 |
| CVE-2025-1878i-Drive i11/i12 WiFi default passwordi-Drive · i11 · CVSS 3.1 · 2025-03-03 | 3.1 | 0.3% | 2025-03-03 |
| CVE-2026-112030diem-project diem dmDataLoad.php default passworddiem-project · diem · CVSS 6.3 · 2026-10-18 | 6.3 | 0.3% | 2026-10-18 |
| CVE-2025-43799Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update…Liferay · Portal · CVSS 6.9 · 2025-09-15 | 6.9 | 0.3% | 2025-09-15 |
| CVE-2026-3186feiyuchuixue sz-boot-parent Password Reset password default passwordfeiyuchuixue · sz-boot-parent · CVSS 6.3 · 2026-02-25 | 6.3 | 0.3% | 2026-02-25 |
| CVE-2025-2347IROAD Dash Cam FX2 Device Registration default passwordIROAD · Dash Cam FX2 · CVSS 6.3 · 2025-03-16 | 6.3 | 0.2% | 2025-03-16 |
| CVE-2025-43021Poly Clariti Manager - Multiple Security VulnerabilitiesHP Inc. · Poly Clariti Manager · CVSS 5.9 · 2025-07-22 | 5.9 | 0.2% | 2025-07-22 |
| CVE-2026-16755A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitiv…Lenovo · Smart Camera C33 · CVSS 5.3 · 2026-10-15 | 5.3 | 0.2% | 2026-10-15 |
| CVE-2025-9589Cudy WR1200EA shadow default passwordCudy · WR1200EA · CVSS 2.5 · 2025-08-28 | 2.5 | 0.1% | 2025-08-28 |
| CVE-2026-8672Default credentials for internal DBsyslink software AG · Avantra · CVSS 5.1 · 2026-05-22 | 5.1 | 0.1% | 2026-05-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.