CWE-258 · Authentication
Empty Password in Configuration File
14CVEs
SortMost likely exploited
14 CVEs with CWE-258 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-5021Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduce…Gliderlabs · Alpine Linux · CVSS 9.8 · 2019-05-08 | 9.8 | 6.3% | 2019-05-08 |
| CVE-2018-17914InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticate…Aveva · InduSoft Web Studio, and InTouch Edge HMI (formerly InTouch Machine Edition) · 2018-11-02 | – | 4.6% | 2018-11-02 |
| CVE-2020-29478CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial of service condition.CA Technologies, A Broadcom Company · CA Service Catalog · 2021-01-05 | – | 1.2% | 2021-01-05 |
| CVE-2026-113736D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty passwordD-Link · DHP-W610AV · CVSS 9.8 · 2026-10-21 | 9.8 | 0.9% | 2026-10-21 |
| CVE-2023-43016IBM Security Access Manager Container unauthorized accessIBM · Security Verify Access Appliance · CVSS 7.3 · 2024-02-03 | 7.3 | 0.7% | 2024-02-03 |
| CVE-2023-39439SAP Commerce accepts empty passphrases.SAP_SE · SAP Commerce · CVSS 8.8 · 2023-08-08 | 8.8 | 0.7% | 2023-08-08 |
| CVE-2025-9276Cockroach Labs cockroach-k8s-request-cert Empty Root Password Authentication Bypass VulnerabilityCockroach Labs · cockroach-k8s-request-cert · CVSS 9.8 · 2025-09-02 | 9.8 | 0.7% | 2025-09-02 |
| CVE-2026-126812blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Composeblueprintue · blueprintue-self-hosted-edition · CVSS 9.8 · 2026-11-11 | 9.8 | 0.6% | 2026-11-11 |
| CVE-2026-84398CareCam CM2507 Empty Password in Configuration FileCareCam · HMT.CM2507 Firmware · CVSS 7.5 · 2026-09-18 | 7.5 | 0.4% | 2026-09-18 |
| CVE-2024-4106A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a pas…Yokogawa Electric Corporation · FAST/TOOLS · CVSS 5.3 · 2024-06-26 | 5.3 | 0.4% | 2024-06-26 |
| CVE-2025-4395Medtronic MyCareLink Patient Monitor Empty Password VulnerabilityMedtronic · MyCareLink Patient Monitor 24950 · CVSS 6.8 · 2025-07-24 | 6.8 | 0.3% | 2025-07-24 |
| CVE-2024-28744The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log…FURUNO SYSTEMS Co.,Ltd. · ACERA 9010-08 · CVSS 8.8 · 2024-04-08 | 8.8 | 0.3% | 2024-04-08 |
| CVE-2024-35137IBM Security Access Manager Docker information disclosureIBM · Security Verify Access Docker · CVSS 6.2 · 2024-06-28 | 6.2 | 0.3% | 2024-06-28 |
| CVE-2025-15679BMC root account active without password on BullSequana XH3406 and XH3515Bull · BullSequana XH3406 · CVSS 7.3 · 2026-09-11 | 7.3 | 0.2% | 2026-09-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.