CWE-1391 Use of Weak Credentials
classThe product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (73)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-37266US | critical9.8 | — | ||
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary com… | ||||
| CVE-2023-0635US | critical9.8 | — | ||
Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQG103204S3021 modules)… | ||||
| CVE-2022-46738US | critical9.8 | — | ||
The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin. | ||||
| CVE-2023-31240US | critical9.8 | — | ||
Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hidden superuser accoun… | ||||
| CVE-2026-109321US | critical9.1 | — | ||
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 ha… | ||||
| CVE-2026-22910US | critical9.1 | — | ||
The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represents a high risk to the… | ||||
| CVE-2023-48257US | high8.8 | — | ||
The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vul… | ||||
| CVE-2024-7558US | high8.0OT erhöht | — | ||
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespa… | ||||
| CVE-2014-7845US | high7.5 | — | ||
The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary p… | ||||
| CVE-2024-45722US | high7.5 | — | ||
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentials. | ||||
| CVE-2022-3010US | high7.5 | — | ||
The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credenti… | ||||
| CVE-2026-107828US | medium6.5 | — | ||
Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from… | ||||
| CVE-2023-3470US | medium6.1 | — | ||
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an aut… | ||||
| CVE-2023-28368US | medium5.7 | — | ||
TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared to spoof the affecte… | ||||
| CVE-2019-0110US | medium5.5 | — | ||
Insufficient key management for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access. | ||||
| CVE-2024-51978US | — | Exploit | ||
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first disco… | ||||
| CVE-2026-113735US | low3.7OT erhöht | — | ||
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipula… | ||||
| CVE-2026-44351US | — | Exploit | ||
fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthen… | ||||
| CVE-2025-53558US | — | Exploit | ||
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected dev… | ||||
| CVE-2024-40892US | — | Exploit | ||
A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the license UUID for authentica… | ||||
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan