CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- eaton easye4 Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password... 7.5 High
- webkul aureus erp Webkul Aureus ERP UserForm.php weak password 6.3 Medium
- misp MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials 9.5 Critical
- hewlett packard enterprise (hpe) aos-cx, hpe arubaos-cx +1 more Credential Manager Vulnerability Allows Unauthorized Administrative Access 8.1 High
- silabs.com wiseconnect SMP security request 8.8 High
- loytec l-dali, l-gate, l-inx +5 more +7 more Loytec LINX firmware: Improper Authentication in PAM configuration 8.4 High
- hcl software mycloud, hcltech dryice mycloud +1 more HCL MyCloud affected by Weak Password Policy 3.1 Low
- ktm system e-bok Weak Password Requirements in KTM System e-BOK 6.9 Medium
- tenda ac15 Tenda AC15 Samba smb.conf weak password 2.3 Low
- ibm operations analytics - log analysis, operations analytics log analysis +1 more IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism 5.9 Medium
- besen bs20 ev charging station Besen BS20 EV Charging Station Bluetooth Low Energy weak password 2.3 Low
- quantum networks router qn-i-470, qntmnet qn-i-470 firmware +1 more Weak Password Policy Vulnerability in Quantum Networks Router QN-I-470 7.6 High
- horner automation cscape, xl7 plc, xl4 plc +2 more Horner Automation Cscape and XL4, XL7 PLC Weak password requirements 9.3 Critical
- juniper networks ctp os, juniper ctp operating system +1 more CTP OS: Configuring password requirements does not work which permits the use of weak passwords 9.1 Critical
- nautobot Nautobot: Management of users via REST API does not apply configured password validators 2.7 Low
- openclaw OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation 6.3 Medium
- openclaw OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting 6.3 Medium
- openclaw OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting 6.3 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 more HCL Aftermarket DPC is affected by Weak Password Policy vulnerability 4.2 Medium
- go-vikunja vikunja Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change 9.1 Critical
- jinan usr iot technology limited (pusr) usr-w610 Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password Requirements 9.8 Critical
- beetel 777vr1, 777vr1 firmware +1 more Beetel 777VR1 UART weak password 1.0 Low
- hcl aion HCL AION is affected by a Weak Password Policy vulnerability 3.1 Low
- huawei emui, harmonyos +1 more Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of... 5.7 Medium
- kaysus ks-wr3600 firmware KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the... 8.4 High
- apache fineract Apache Fineract: weak password policy 8.5 High
- elastic endpoint FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API 6.9 Medium
- thermofisher ion torrent onetouch 2 firmware An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an... 9.8 Critical
- librenms LibreNMS has Weak Password Policy 3.7 Low
- opensourcepos open source point of sale The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account... 7.5 High
- testmanagement qatraq QaTraq 6.9.2 ships with administrative account credentials which are enabled in default... 9.8 Critical
- general industrial controls lynx+ gateway General Industrial Controls Lynx+ Gateway Weak Password Requirements 8.8 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Insufficient Password Policy 6.9 Medium
- lfprojects mlflow MLflow Weak Password Requirements Authentication Bypass Vulnerability 8.1 High
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Weak Password Policy 10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 more Missing Initial Password Change 10.0 Critical
- microweber Microweber CMS 2.0 has Weak Password Requirements. The application does not enforce minimum... 8.3 High
- mangati novosga Mangati NovoSGA User Creation new weak password 6.3 Medium
- ibm transformation extender advanced IBM Transformation Extender Advanced information disclosure 5.9 Medium
- novakon p series (p07, p10, p12, p15) Weak Authentication for Root User 8.6 High
- h3c magic nx15 firmware H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to... 8.0 High
- iteachyou dreamer cms iteachyou Dreamer CMS updatePwd weak password 2.3 Low
- macrozheng mall macrozheng mall Registration weak password 6.3 Medium
- kapsch ris-9160 firmware, ris-9260 firmware +1 more Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4... 6.8 Medium
- No product listed An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's... 9.8 Critical
- 7ritn vaultls VaulTLS has a password-based login exploit in additional user accounts 9.4 Critical
- No product listed An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either... 9.8 Critical
- atjiu pybbs atjiu pybbs UserAdminController.java update weak password 6.3 Medium
- quantum superloader Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account... 5.8 Medium
- tenda ac18, ac18 firmware +1 more Tenda AC18 Samba smb.conf weak password 6.3 Medium
- Show olderLoading…