CWE-521
Weak Password Requirements
Description
The product does not require that users should have strong passwords.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-112 · CAPEC-16 · CAPEC-49 · CAPEC-509 · CAPEC-55 · CAPEC-555 · CAPEC-561 · CAPEC-565 · CAPEC-70
CVEs mapped to this weakness (264)
page 5 of 14| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-31098 | Cri | 0.57 | 9.8 | 0.01 | May 22, 2023 | Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess the user's… | ||
| CVE-2023-2106 | Cri | 0.57 | 9.8 | 0.01 | Apr 15, 2023 | Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. | ||
| CVE-2023-0307 | Cri | 0.57 | 9.8 | 0.01 | Jan 15, 2023 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10. | ||
| CVE-2022-3754 | Cri | 0.57 | 9.8 | 0.01 | Oct 29, 2022 | Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. | ||
| CVE-2022-2927 | Cri | 0.57 | 9.8 | 0.01 | Aug 22, 2022 | Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7. | ||
| CVE-2022-35143 | Cri | 0.57 | 9.8 | 0.02 | Aug 4, 2022 | Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. | ||
| CVE-2022-26117 | Hig | 0.57 | 8.8 | 0.01 | Jul 18, 2022 | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL… | ||
| CVE-2022-30325 | Hig | 0.57 | 8.8 | 0.00 | Jun 16, 2022 | An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or… | ||
| CVE-2020-11925 | Hig | 0.57 | 8.8 | 0.01 | Apr 2, 2021 | An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model. | ||
| CVE-2020-15369 | Hig | 0.57 | 8.8 | 0.01 | Sep 25, 2020 | Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to… | ||
| CVE-2018-18562 | Hig | 0.57 | 8.8 | 0.01 | Nov 20, 2018 | An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service… | ||
| CVE-2018-17906 | Hig | 0.57 | 8.8 | 0.01 | Nov 19, 2018 | Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system. | ||
| CVE-2018-15748 | Hig | 0.57 | 8.8 | 0.01 | Aug 23, 2018 | On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the… | ||
| CVE-2018-1000134 | Cri | 0.57 | 9.8 | 0.05 | Mar 16, 2018 | UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't… | ||
| CVE-2025-9964 | Hig | 0.56 | — | 0.00 | Sep 23, 2025 | No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9). | ||
| CVE-2023-40707 | Hig | 0.56 | 8.6 | 0.00 | Aug 24, 2023 | There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials. | ||
| CVE-2025-68716 | Hig | 0.55 | 8.4 | 0.00 | Jan 8, 2026 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI or web GUI. This allows any LAN-adjacent… | ||
| CVE-2025-60954 | Hig | 0.54 | 8.3 | 0.00 | Oct 24, 2025 | Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including… | ||
| CVE-2025-55299 | Cri | 0.54 | 9.4 | 0.00 | Aug 18, 2025 | VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that… | ||
| CVE-2021-32753 | Hig | 0.54 | 8.3 | 0.01 | Jul 9, 2021 | EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a… |
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess the user's…
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
- risk 0.57cvss 9.8epss 0.01
Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7.
- risk 0.57cvss 9.8epss 0.02
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
- risk 0.57cvss 8.8epss 0.01
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL…
- risk 0.57cvss 8.8epss 0.00
An issue was found on TRENDnet TEW-831DR 1.0 601.130.1.1356 devices. The default pre-shared key for the Wi-Fi networks is the same for every router except for the last four digits. The device default pre-shared key for both 2.4 GHz and 5 GHz networks can be guessed or…
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model.
- risk 0.57cvss 8.8epss 0.01
Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to…
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service…
- risk 0.57cvss 8.8epss 0.01
Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.
- risk 0.57cvss 8.8epss 0.01
On Dell 2335dn printers with Printer Firmware Version 2.70.05.02, Engine Firmware Version 1.10.65, and Network Firmware Version V4.02.15(2335dn MFP) 11-22-2010, the admin interface allows an authenticated attacker to retrieve the configured SMTP or LDAP password by viewing the…
- risk 0.57cvss 9.8epss 0.05
UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't…
- risk 0.56cvss —epss 0.00
No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
- risk 0.56cvss 8.6epss 0.00
There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials.
- risk 0.55cvss 8.4epss 0.00
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The root account is configured with no password, and administrators cannot disable SSH or enforce authentication via the CLI or web GUI. This allows any LAN-adjacent…
- risk 0.54cvss 8.3epss 0.00
Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum password length or complexity during password resets. Users can set extremely weak passwords, including single-character passwords, which can lead to account compromise, including…
- risk 0.54cvss 9.4epss 0.00
VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that…
- risk 0.54cvss 8.3epss 0.01
EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a…