CWE-521 Weak Password Requirements
baseThe product does not require that users should have strong passwords.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (302)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-18988US | high7.0OT critical | KEV | ||
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key fo… | ||||
| CVE-2019-17444US | critical9.8 | — | ||
Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attac… | ||||
| CVE-2024-48845US | critical9.8 | Exploit | ||
Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access.
Affec… | ||||
| CVE-2023-37756US | critical9.8 | Exploit | ||
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a… | ||||
| CVE-2012-2441US | high8.5 | Exploit | ||
RuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address field in a banner, which makes it easier for remote attackers… | ||||
| CVE-2021-43471US | high7.5 | Exploit | ||
In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after entering the background, cr… | ||||
| CVE-2018-1000134US | critical9.8 | — | ||
UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contai… | ||||
| CVE-2017-3186US | critical9.8OT elevated | — | ||
ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote attacker can take comple… | ||||
| CVE-2015-3972US | high10.0 | — | ||
The web interface on Janitza UMG 508, 509, 511, 604, and 605 devices supports only short PIN values for authentication, which makes it easier for remote attackers to obtain access… | ||||
| CVE-2025-11200US | critical9.8 | — | ||
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Auth… | ||||
| CVE-2023-29974US | critical9.8 | — | ||
An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. | ||||
| CVE-2022-34615US | critical9.8 | — | ||
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. | ||||
| CVE-2022-35143US | critical9.8 | — | ||
Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. | ||||
| CVE-2022-31211US | critical9.8 | — | ||
An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default. | ||||
| CVE-2022-1668US | critical9.8 | — | ||
Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH. | ||||
| CVE-2022-1775US | critical9.8 | — | ||
Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. | ||||
| CVE-2021-43036US | critical9.8 | — | ||
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. | ||||
| CVE-2020-29591US | critical9.8 | — | ||
Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of the registry container may all… | ||||
| CVE-2020-26201US | critical9.8 | — | ||
Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. This allows an attacker to gain unauthorized access as an admi… | ||||
| CVE-2020-8790US | critical9.8 | — | ||
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excessive authentication at… | ||||
04
attack patterns (9)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan