CWE-1392
Use of Default Credentials
Description
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Hierarchy (View 1000)
CVEs mapped to this weakness (109)
page 4 of 6| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-36915 | Hig | 0.49 | 7.5 | 0.00 | Jan 6, 2026 | Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands… | ||
| CVE-2018-25147 | Hig | 0.49 | 7.5 | 0.00 | Dec 24, 2025 | Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password… | ||
| CVE-2025-35114 | Hig | 0.49 | 7.5 | 0.00 | Aug 26, 2025 | Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30. | ||
| CVE-2024-13893 | Hig | 0.49 | — | 0.00 | Mar 6, 2025 | Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory. For the telnet service to… | ||
| CVE-2024-12013 | — | Hig | 0.49 | 7.6 | 0.00 | Feb 13, 2025 | A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could… | |
| CVE-2024-54015 | Hig | 0.49 | 7.5 | 0.01 | Feb 11, 2025 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89… | ||
| CVE-2025-23012 | Hig | 0.49 | 7.5 | 0.00 | Jan 23, 2025 | Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported… | ||
| CVE-2025-11943 | Hig | 0.48 | 7.3 | 0.01 | Oct 19, 2025 | A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to… | ||
| CVE-2025-1160 | Hig | 0.48 | 7.3 | 0.01 | Feb 10, 2025 | A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default credentials. The… | ||
| CVE-2024-6245 | Hig | 0.48 | 7.4 | 0.00 | Oct 28, 2024 | Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects SmartPlay:… | ||
| CVE-2024-27158 | Hig | 0.48 | 7.4 | 0.00 | Jun 14, 2024 | All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL. | ||
| CVE-2024-31069 | Hig | 0.48 | 7.4 | 0.00 | Apr 12, 2024 | IO-1020 Micro ELD web server uses a default password for authentication. | ||
| CVE-2024-30210 | Hig | 0.48 | 7.4 | 0.00 | Apr 12, 2024 | IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device. | ||
| CVE-2025-2398 | Hig | 0.47 | 7.2 | 0.01 | Mar 17, 2025 | A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical. This issue affects some unknown processing of the component CLI su Command Handler. The manipulation leads to use of… | ||
| CVE-2025-0482 | Hig | 0.47 | 7.3 | 0.01 | Jan 15, 2025 | A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit… | ||
| CVE-2024-7898 | Hig | 0.47 | 7.3 | 0.01 | Aug 17, 2024 | A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be… | ||
| CVE-2026-28713 | Hig | 0.46 | 7.1 | 0.00 | Mar 6, 2026 | Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186. | ||
| CVE-2024-46899 | Hig | 0.46 | 7.1 | 0.00 | Apr 22, 2025 | Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue affects Hitachi Ops Center Common Services: from 10.0.0-00 before 11.0.0-04; Hitachi Ops Center Analyzer viewpoint OVF:… | ||
| CVE-2024-45068 | Hig | 0.46 | 7.1 | 0.00 | Dec 3, 2024 | Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-01. | ||
| CVE-2023-40704 | Med | 0.44 | 6.8 | 0.00 | Jul 18, 2024 | The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and… |
- risk 0.49cvss 7.5epss 0.00
Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands…
- risk 0.49cvss 7.5epss 0.00
Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password…
- risk 0.49cvss 7.5epss 0.00
Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is known for at least one of the accounts and the credentials could be cracked offline. Users should upgrade to Agiloft Release 30.
- risk 0.49cvss —epss 0.00
Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory. For the telnet service to…
- risk 0.49cvss 7.6epss 0.00
A CWE-1392 “Use of Default Credentials” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. The device exposes an FTP server with default and easy-to-guess admin credentials. A remote attacker capable of interacting with the FTP server could…
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD86 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89 (CP300) (All versions >= V8.80 < V9.90), SIPROTEC 5 6MD89…
- risk 0.49cvss 7.5epss 0.00
Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported…
- risk 0.48cvss 7.3epss 0.01
A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality of the component HTTP Web Server. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed to…
- risk 0.48cvss 7.3epss 0.01
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default credentials. The…
- risk 0.48cvss 7.4epss 0.00
Use of Default Credentials vulnerability in Maruti Suzuki SmartPlay on Linux (Infotainment Hub modules) allows attacker to try common or default usernames and passwords.The issue was detected on a 2022 Maruti Suzuki Brezza in India Market. This issue affects SmartPlay:…
- risk 0.48cvss 7.4epss 0.00
All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL.
- risk 0.48cvss 7.4epss 0.00
IO-1020 Micro ELD web server uses a default password for authentication.
- risk 0.48cvss 7.4epss 0.00
IO-1020 Micro ELD uses a default WIFI password that could allow an adjacent attacker to connect to the device.
- risk 0.47cvss 7.2epss 0.01
A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical. This issue affects some unknown processing of the component CLI su Command Handler. The manipulation leads to use of…
- risk 0.47cvss 7.3epss 0.01
A vulnerability, which was classified as critical, was found in Fanli2012 native-php-cms 1.0. This affects an unknown part of the file /fladmin/user_recoverpwd.php. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit…
- risk 0.47cvss 7.3epss 0.01
A vulnerability classified as critical was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This vulnerability affects unknown code of the component Backend. The manipulation leads to use of default credentials. The attack can be…
- risk 0.46cvss 7.1epss 0.00
Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.
- risk 0.46cvss 7.1epss 0.00
Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerability.This issue affects Hitachi Ops Center Common Services: from 10.0.0-00 before 11.0.0-04; Hitachi Ops Center Analyzer viewpoint OVF:…
- risk 0.46cvss 7.1epss 0.00
Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-01.
- risk 0.44cvss 6.8epss 0.00
The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and…