CWEweakness

CWE-1393 Use of Default Password

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Go, Not Language-Specific
CWE version
5.0

Description

The product uses default passwords for potentially critical functionality.

Common consequences

• Authentication: Gain Privileges or Assume Identity

Potential mitigations

• [Requirements] Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations. • [Documentation] Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them. • [Architecture and Design] Force the administrator to change the credential upon installation. • [Installation, Operation] The product administrator could change the defaults upon installation or during operation.

Detection methods

• Automated Analysis: There are many lists of default passwords and default-password scanning tools that are easily available.

Observed examples

• CVE-2022-30270: Remote Terminal Unit (RTU) uses default credentials for some SSH accounts • CVE-2022-2336: OPC Unified Architecture (OPC UA) industrial automation product has a default password • CVE-2021-38759: microcontroller board has default password, allowing admin access • CVE-2021-44480: children's smart watch has default passwords allowing attackers to send SMS commands and listen to the device's surroundings • CVE-2020-11624: surveillance camera has default password for the admin account • CVE-2018-15719: medical dental records product installs a MySQL database with a blank default password • CVE-2014-9736: healthcare system for archiving patient images has default passwords for key management and storage databases • CVE-2000-1209: database product installs admin account with default null password, allowing privileges, as exploited by various worms

Related

Observed example · CVE (8)

  • CVE-2022-2336 Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin`… vulnerability
  • CVE-2022-30270 The Motorola ACE1000 RTU through 2022-05-02 has default credentials. vulnerability
  • CVE-2021-38759 Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. vulnerability
  • CVE-2021-44480 Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's… vulnerability
  • CVE-2020-11624 An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP… vulnerability
  • CVE-2018-15719 Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password. vulnerability
  • CVE-2014-9736 GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2)… vulnerability
  • CVE-2000-1209 The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE)… vulnerability

Child of · CWE (1)

  • CWE-1392 Use of Default Credentials weakness

Referenced by CVE · weakness (48)

  • CVE-2026-112030 A vulnerability was found in diem-project diem up to 5.1.3. vulnerability
  • CVE-2026-16755 A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an… vulnerability
  • CVE-2026-69657 XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). vulnerability
  • CVE-2026-82698 A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. vulnerability
  • CVE-2026-19851 A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access… vulnerability
  • CVE-2026-16503 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with… vulnerability
  • CVE-2026-16504 Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and… vulnerability
  • CVE-2026-5269 In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software… vulnerability
  • CVE-2026-54445 vantage6 is an open-source infrastructure for privacy preserving analysis. vulnerability
  • CVE-2026-35075 An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all… vulnerability
  • CVE-2026-8672 Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. vulnerability
  • CVE-2026-33784 A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an… vulnerability
  • CVE-2025-14917 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than… vulnerability
  • CVE-2026-4404 Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to… vulnerability
  • CVE-2026-22886 OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. vulnerability
  • CVE-2026-3186 A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. vulnerability
  • CVE-2026-2635 MLflow Use of Default Password Authentication Bypass Vulnerability. vulnerability
  • CVE-2026-24429 Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in… vulnerability
  • CVE-2025-66050 Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as an administrator. vulnerability
  • CVE-2025-8077 A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the… vulnerability
  • CVE-2025-43799 Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA… vulnerability
  • CVE-2025-9589 A vulnerability was determined in Cudy WR1200EA 2.3.7-20250113-121810. vulnerability
  • CVE-2025-43021 A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. vulnerability
  • CVE-2025-2766 70mai A510 Use of Default Password Authentication Bypass Vulnerability. vulnerability
  • CVE-2024-13966 ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default… vulnerability
  • CVE-2025-27690 Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. vulnerability
  • CVE-2025-22938 Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords. vulnerability
  • CVE-2025-2921 A vulnerability classified as critical has been found in Netis WF-2404 1.1.124EN. vulnerability
  • CVE-2024-49559 Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. vulnerability
  • CVE-2025-2347 A vulnerability was found in IROAD Dash Cam FX2 up to 20250308 and classified as problematic. vulnerability
Show all 48 ›

Referenced by CWE · has member (1)

  • CWE-1468 Weaknesses Addressed by the OWASP Golang Secure Coding Practices Guide view

Referenced by OWASP · mapped cwe (1)

  • A07:2025 Authentication Failures Top 10 2025