CWE-521 · Authentication
Weak Password Requirements
241CVEs
SortMost likely exploited
241 CVEs with CWE-521 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-18988In CISA KEVExploitedTeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key f…TeamViewer · Desktop · CVSS 7 · 2020-02-07 | 7.0 | 4.7% | 2020-02-07 |
| CVE-2019-17444CheckJfrog Artifactory <6.17.0 - Default Admin PasswordJfrog · Artifactory · CVSS 9.8 · 2020-10-12 | 9.8 | 69% | 2020-10-12 |
| CVE-2012-2441RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers…Siemens · Ruggedcom Rugged Operating System · 2012-04-28 | – | 8.5% | 2012-04-28 |
| CVE-2017-3186ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take compl…ACTi Corporation · ACTi D, B, I, and E series cameras · 2017-12-15 | – | 6.1% | 2017-12-15 |
| CVE-2018-1000134UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed conta…Pingidentity · Ldapsdk · 2018-03-16 | – | 4.7% | 2018-03-16 |
| CVE-2022-43030Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS…Siyucms · Siyucms · CVSS 7.2 · 2022-11-14 | 7.2 | 4.6% | 2022-11-14 |
| CVE-2017-7903A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 an…Rockwellautomation · Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 · CVSS 9.8 · 2017-06-30 | 9.8 | 3.8% | 2017-06-30 |
| CVE-2017-12861The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit code, displayed on-scre…Epson · Easymp · 2017-10-10 | – | 3.3% | 2017-10-10 |
| CVE-2018-5389CVE-2018-5389strongSwan · Strongswan · 2018-09-06 | – | 3.1% | 2018-09-06 |
| CVE-2020-11966In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vuln…Evenroute · Iqrouter Firmware · 2020-04-21 | – | 3.1% | 2020-04-21 |
| CVE-2017-14189An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password.Fortinet, Inc. · FortiWebManager · 2017-11-29 | – | 2.8% | 2017-11-29 |
| CVE-2020-29591Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may al…Docker · Registry · 2020-12-11 | – | 2.6% | 2020-12-11 |
| CVE-2020-26201Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an adm…Askey · Ap5100w Firmware · 2020-12-10 | – | 2.4% | 2020-12-10 |
| CVE-2017-1601IBM Security Guardium 10.0, 10.0.1, and 10.1 through 10.1.4 Database Activity Monitor does not require that users should have strong passwords by default, which makes it easier fo…Ibm · Security Guardium Database Activity Monitor · 2018-05-02 | – | 2.4% | 2018-05-02 |
| CVE-2019-9950Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmwar…Westerndigital · My Cloud Pr4100 Firmware · 2019-04-24 | – | 2.3% | 2019-04-24 |
| CVE-2022-1668Secheron SEPCOS Control and Protection RelaySecheron · SEPCOS Control and Protection Relay firmware package · CVSS 9.8 · 2022-06-24 | 9.8 | 2.3% | 2022-06-24 |
| CVE-2022-1775Weak Password Requirements in polonel/trudeskpolonel · polonel/trudesk · CVSS 8.4 · 2022-05-20 | 8.4 | 2.2% | 2022-05-20 |
| CVE-2023-29974An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.Pfsense · Pfsense · CVSS 9.8 · 2023-11-08 | 9.8 | 2.2% | 2023-11-08 |
| CVE-2018-1372IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise use…IBM · Security Guardium Big Data Intelligence · 2018-02-27 | – | 2.2% | 2018-02-27 |
| CVE-2018-1956IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-For…IBM · Security Identity Manager · CVSS 5.9 · 2019-01-14 | 5.9 | 2.0% | 2019-01-14 |
| CVE-2017-1597IBM Security Guardium 10.0, 10.0.1, 10.1, 10.1.2, 10.1.3, 10.1.4, and 10.5 Database Activity Monitor does not require that users should have strong passwords by default, which mak…IBM · Security Guardium · CVSS 5.9 · 2018-12-17 | 5.9 | 2.0% | 2018-12-17 |
| CVE-2018-19064An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application…Opticam · I5 Application Firmware · 2018-11-07 | – | 2.0% | 2018-11-07 |
| CVE-2021-43036An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak.Kaseya · Unitrends Backup · 2021-12-06 | – | 1.9% | 2021-12-06 |
| CVE-2020-4574IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force…IBM · Security Key Lifecycle Manager · CVSS 7.4 · 2020-07-29 | 7.4 | 1.9% | 2020-07-29 |
| CVE-2024-48845Weak Password Rules/StrengthABB · ASPECT-Enterprise · CVSS 9.4 · 2024-12-05 | 9.4 | 1.8% | 2024-12-05 |
| CVE-2019-9096An issue was discovered on Moxa MGate MB3170 and MB3270 devices before 4.1, MB3280 and MB3480 devices before 3.1, MB3660 devices before 2.3, and MB3180 devices before 2.1. Insuffi…Moxa · Mb3170 Firmware · CVSS 9.8 · 2020-03-11 | 9.8 | 1.8% | 2020-03-11 |
| CVE-2017-9853An issue was discovered in SMA Solar Technology products. All inverters have a very weak password policy for the user and installer password. No complexity requirements or length…Sma · Sunny Boy 3600 Firmware · 2017-08-05 | – | 1.7% | 2017-08-05 |
| CVE-2022-35143Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.Raneto Project · Raneto · 2022-08-04 | – | 1.7% | 2022-08-04 |
| CVE-2022-31211An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default.Infiray · Iray-A8z3 Firmware · 2022-07-17 | – | 1.7% | 2022-07-17 |
| CVE-2019-7676A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account.Enphase · Envoy · 2019-02-09 | – | 1.7% | 2019-02-09 |
| CVE-2017-1196IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accou…IBM · Endpoint Manager for Security and Compliance · 2017-06-07 | – | 1.7% | 2017-06-07 |
| CVE-2022-34615Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.Mealie · Mealie · 2022-08-19 | – | 1.6% | 2022-08-19 |
| CVE-2020-6995In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements, which may allow an a…Moxa · Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Ve… · 2020-03-24 | – | 1.6% | 2020-03-24 |
| CVE-2020-25153MOXA NPort IAW5000A-I/O SeriesMOXA · NPort IAW5000A-I/O · CVSS 9.8 · 2020-12-23 | 9.8 | 1.6% | 2020-12-23 |
| CVE-2017-1221IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user ac…IBM · BigFix Platform · 2017-11-13 | – | 1.6% | 2017-11-13 |
| CVE-2022-3754Weak Password Requirements in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq · CVSS 7.5 · 2022-10-29 | 7.5 | 1.6% | 2022-10-29 |
| CVE-2022-29729Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessible to unauthenticated…Verizon · 4g Lte Network Extender Firmware · 2022-05-27 | – | 1.5% | 2022-05-27 |
| CVE-2020-6991In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.Moxa · Moxa EDS-G516E Series firmware, Version 5.2 or lower · 2020-03-24 | – | 1.5% | 2020-03-24 |
| CVE-2019-9123An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. The "user" account has a blank password.Dlink · Dir-825 Rev.b Firmware · 2019-02-25 | – | 1.5% | 2019-02-25 |
| CVE-2011-4931gpw generates shorter passwords than requiredgpw · gpw · 2019-10-29 | – | 1.5% | 2019-10-29 |
| CVE-2020-9023Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords (User bluetooth, password bluetooth; User…Iteris · Vantage Velocity Firmware · 2020-02-17 | – | 1.5% | 2020-02-17 |
| CVE-2021-43471In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, c…Canon · Lbp223dw Firmware · 2021-12-06 | – | 1.5% | 2021-12-06 |
| CVE-2019-4565IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accoun…IBM · Security Key Lifecycle Manager · CVSS 5.9 · 2019-09-20 | 5.9 | 1.5% | 2019-09-20 |
| CVE-2018-1680IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compro…IBM · Security Privileged Identity Manager · CVSS 5.9 · 2019-04-02 | 5.9 | 1.5% | 2019-04-02 |
| CVE-2017-18857The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement.Netgear · Insight · 2020-04-28 | – | 1.5% | 2020-04-28 |
| CVE-2019-4321IBM Intelligent Operations Center V5.1.0 - V5.2.0, IBM Intelligent Operations Center for Emergency Management V5.1.0 - V5.1.0.6, and IBM Water Operations for Waternamics V5.1.0 -…IBM · Intelligent Operations Center · CVSS 5.9 · 2019-09-05 | 5.9 | 1.5% | 2019-09-05 |
| CVE-2019-4235IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user acco…IBM · PureApplication System · CVSS 5.9 · 2019-06-26 | 5.9 | 1.5% | 2019-06-26 |
| CVE-2019-4067IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise…IBM · Intelligent Operations Center · CVSS 5.9 · 2019-06-07 | 5.9 | 1.5% | 2019-06-07 |
| CVE-2019-19690Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an attacker could bypass the product's App Password Protection f…Trend Micro · Trend Micro Mobile Security for Android (Consumer) · 2019-12-18 | – | 1.5% | 2019-12-18 |
| CVE-2023-37756I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via…I-Doit · I-Doit · 2023-09-14 | – | 1.4% | 2023-09-14 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.