CWE-1391

56 CVEs classified under CWE-1391. Browse by severity and year.

Top CVEs for CWE-1391
CVESeverityScorePublishedSummary
CVE-2026-39920Critical9.82026-04-24BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default…
CVE-2025-67114Critical9.82026-03-19Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804…
CVE-2026-22886Critical9.82026-03-03OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative ac…
CVE-2025-30519Critical9.82025-09-18Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker w…
CVE-2025-6077Critical9.82025-08-02Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account…
CVE-2024-51978Critical9.82025-06-25An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated att…
CVE-2024-12728Critical9.82024-12-19A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
CVE-2024-43698Critical9.82024-10-22Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.
CVE-2026-45363Critical9.12026-07-14ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') acc…
CVE-2026-44351Critical9.12026-05-13fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flo…
CVE-2025-53558High8.82025-07-31ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log i…
CVE-2024-28066High8.82024-04-08In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
CVE-2024-29071High8.82024-03-25HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.
CVE-2026-79679High8.72026-09-03Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services…
CVE-2024-7558High8.72024-10-02JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the…
CVE-2026-23853High8.42026-04-17Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug…
CVE-2023-31240High8.32023-05-22Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hi…
CVE-2024-42051High7.82024-07-28The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit…
CVE-2023-48257High7.82024-01-10The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o…
CVE-2023-0635High7.82023-06-05Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQ…
All CVEs classified under CWE-1391 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-79679High8.72026-09-03Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services…
CVE-2026-66409Medium5.32026-08-10DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect t…
CVE-2026-66408Medium4.62026-08-10The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the pas…
CVE-2026-498522026-07-17joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode…
CVE-2026-45363Critical9.12026-07-14ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') acc…
CVE-2026-574732026-06-26A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force…
CVE-2026-473252026-06-03ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth…
CVE-2026-43772026-05-28Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords a…
CVE-2026-350892026-05-27In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange which can be obtained without authenti…
CVE-2026-44351Critical9.12026-05-13fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flo…
CVE-2026-80762026-05-08Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The…
CVE-2026-39920Critical9.82026-04-24BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default…
CVE-2026-23853High8.42026-04-17Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 throug…
CVE-2025-67114Critical9.82026-03-19Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@230804…
CVE-2026-22886Critical9.82026-03-03OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative ac…
CVE-2026-24449Medium4.62026-02-03For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.
CVE-2025-591032026-01-26The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it…
CVE-2026-22910High7.52026-01-15The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represen…
CVE-2025-59460High7.52025-10-27The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increas…
CVE-2025-30519Critical9.82025-09-18Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker w…
CVE-2025-6737High7.22025-08-25Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authen…
CVE-2025-55584Medium5.32025-08-18TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.
CVE-2025-35970High7.52025-08-07On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If t…
CVE-2025-6077Critical9.82025-08-02Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account…
CVE-2025-53558High8.82025-07-31ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log i…
CVE-2025-6523High7.72025-07-22Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forci…
CVE-2025-52364High7.52025-07-09Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /e…
CVE-2024-51978Critical9.82025-06-25An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated att…
CVE-2025-4057Medium5.52025-05-26A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
CVE-2025-32471Low3.72025-04-28The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.
CVE-2025-2229High7.72025-03-13A token is created using the username, current date/time, and a fixed AES-128 encryption key, which is the same across all installations.
CVE-2025-1081Low3.12025-02-06A vulnerability was found in Bharti Airtel Xstream Fiber up to 20250123. It has been rated as problematic. This issue affects some unknown processing of the co…
CVE-2025-22936Medium5.72025-02-06An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W-A1 allows a remote attacker to obtain sensitive information vi…
CVE-2024-52331High7.52025-01-23ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that…
CVE-2024-43659High7.22025-01-09After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc…
CVE-2024-117172025-01-02Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a…
CVE-2024-12728Critical9.82024-12-19A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3).
CVE-2024-45722High7.52024-12-06Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses weak credential mechanism that could allow an attacker to easily calculate MQTT credentia…
CVE-2024-43698Critical9.82024-10-22Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.
CVE-2024-45272High7.52024-10-15An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in…
CVE-2024-42027Medium6.72024-10-07The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they have the appropriate t…
CVE-2024-7558High8.72024-10-02JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the…
CVE-2024-40892High7.12024-08-12A weak credential vulnerability exists in Firewalla Box Software versions before 1.979. This vulnerability allows a physically close attacker to use the licens…
CVE-2024-42051High7.82024-07-28The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit…
CVE-2024-327592024-07-10Under certain circumstances the Software House C●CURE 9000 installer will utilize weak credentials.
CVE-2024-56342024-07-09Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is k…
CVE-2024-33849Medium6.52024-05-28ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.
CVE-2024-28066High8.82024-04-08In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
CVE-2024-21865Medium6.52024-03-25HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via S…
CVE-2024-29071High8.82024-03-25HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.
CVE-2023-48257High7.82024-01-10The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges o…
CVE-2022-3010High7.52024-01-02The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calcula…
CVE-2023-3470Medium6.02023-08-02 Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account.  The predictable nature of the p…
CVE-2023-0635High7.82023-06-05Improper Privilege Management vulnerability in ABB Ltd. ASPECT®-Enterprise on ASPECT®-Enterprise, Linux (2CQG103201S3021, 2CQG103202S3021, 2CQG103203S3021, 2CQ…
CVE-2023-31240High8.32023-05-22Snap One OvrC Pro versions prior to 7.2 have their own locally running web server accessible both from the local network and remotely. OvrC cloud contains a hi…
CVE-2023-28368Medium5.72023-04-11TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared…