CWE-1391: Use of Weak Credentials
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- jumis pro sia jumis Universal sysadmin credential vulnerability in Jumis 9.3 Critical
- authlib Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) 7.4 High
- d-link dcs-6501lh D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials 6.3 Medium
- rakuten mobile, inc. bigs, hand, hand 5g +1 more +3 more Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android... 7.0 High
- getgrav grav-plugin-login-oauth Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass 9.3 Critical
- banq jivejdon Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login 6.9 Medium
- anjvision yssd-rtmp-h5 Use of Weak Credentials in Anjvision YSSD-RTMP-H5 7.0 High
- evbee dc 80 Weak root password in EVbee DC 80 9.3 Critical
- botslab g980h Botslab G980H Dashcams Use of Weak Credentials 6.0 Medium
- b&r industrial automation gmbh mapp services Use of Weak Credentials 7.0 High
- ecovacs robotics deebot pro k1vac, deebot pro m1 +1 more DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot... 6.9 Medium
- ecovacs robotics deebot pro k1vac, deebot pro m1 +1 more The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords.... 5.1 Medium
- authlib joserfc joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) 8.7 High
- openidentityplatform openam OpenAM Account Takeover via Unverified Password Change in OAuth2 Module 7.4 High
- reolink home hub A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior... 5.8 Medium
- projectsandprograms school-management-system Weak password policy in ProjectsAndPrograms school-management-system 6.9 Medium
- d-link corporation dwr-x1820 Use of Weak Credentials in D-Link DWR-X1820 router 6.0 Medium
- slican cct-1668, cxs-0424, ipx +1 more +3 more Use of Weak Credentials in Slican telephone exchanges 8.7 High
- jwt ruby-jwt `jwt` (Ruby gem) - empty-key HMAC bypass 9.1 Critical
-
github.com/slack-go/slackGo slack-go `SecretsVerifier` accepts empty signing secret without precondition 4.8 Medium - cashdro 3 administration panel Weak credentials vulnerability in the CashDro 3 web administration panel 9.3 Critical
- nearform fast-jwt fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass 9.1 Critical
- bridgehead software filestore BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE 9.3 Critical
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 more Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release... 8.4 High
- No product listed Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm... 9.8 Critical
- eclipse openmq OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires... 9.8 Critical
- elecom co.,ltd. wrc-x1500gs-b, wrc-x1500gsa-b, elecom wrc-x1500gs-b firmware +1 more +3 more For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the... 5.1 Medium
- dormakaba access manager 92xx-k5 Weak Default Passwords for SSH Access in dormakaba access manager 9.2 Critical
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 more The device is deployed with weak and publicly known default passwords for certain hidden user... 7.5 High
- sick tloc100-100 firmware, sick ag tloc100-100 with firmware <7.1.1, tloc100-100 with firmware >=7.1.1 +2 more Unsecure access configuration 7.5 High
- dover fueling solutions progauge maglink lx 4, progauge maglink lx plus, progauge maglink lx ultimate +2 more Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Weak Credentials 9.3 Critical
- securden unified pam Securden Unified PAM Shared SSH Key and Cloud Infrastructure 7.2 High
- totolink a3002r firmware TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the... 5.3 Medium
- fujifilm corporation frontier dx400w, seiko epson multiple epson product +1 more On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password... 8.7 High
- partner software web CVE-2025-6077 9.8 Critical
- zte japan. k.k. zxhn-f660a, zxhn-f660t +1 more ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all... 8.7 High
- devolutions server Use of weak credentials in emergency authentication component in Devolutions Server allows an... 9.5 Critical
- tenda cp3 pro firmware Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service... 7.5 High
- brother industries, ltd ads-1250w, ads-1350w, ads-1700w +602 more +604 more Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc. 9.8 Critical
- red hat amq broker 7.13.0.opr.1.ga, amq broker 7.12.5, rhel-8 based middleware containers +2 more Activemq-artemis-operator: amq broker operator starting credentials reuse 5.5 Medium
- sick ag flx3-cpuc200, tdc-x401gl +1 more Reuse of salt 3.7 Low
- philips intellispace cardiovascular (iscv) Philips Intellispace Cardiovascular (ISCV) Use of Weak Credentials 8.5 High
- bharti airtel xstream fiber Bharti Airtel Xstream Fiber WiFi Password weak credentials 2.3 Low
- No product listed An issue in Smartcom Bulgaria AD Smartcom Ralink CPE/WiFi router SAM-4G1G-TT-W-VC, SAM-4F1F-TT-W... 5.7 Medium
- ecovacs airbot andy firmware, airbot ava firmware, airbot z1 firmware +12 more +14 more ECOVACS lawnmowers and vacuums deterministic firmware encryption key 7.7 High
- iocharger firmware for ac models Plaintext default credentials in firmware 8.3 High
- ctfd Tokens in CTFd used for account activation and password resetting can be used interchangeably for... 6.3 Medium
- sophos firewall, firewall firmware +1 more A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos... 9.8 Critical
- ruijie reyee os Ruijie Reyee OS Use of Weak Credentials 8.7 High
- kieback&peter ddc4002, ddc4002e, ddc4020e +17 more +19 more Kieback&Peter DDC4000 Series Use of Weak Credentials 9.3 Critical
- Show olderLoading…