Weaknesses of type CWE-1392

116 results

Uso de Credenciais Padrão

A aplicação ou serviço é implantado com credenciais (usuários, senhas, chaves) pré-configuradas e conhecidas publicamente, sem obrigar a mudança na primeira inicialização. Um atacante externo consegue acessar funcionalidades sensíveis usando essas credenciais padrão, contornando completamente o controle de acesso.

Example

Um roteador, câmera IP ou painel administrativo vem com user 'admin' e senha 'admin' ou '12345'. Se o usuário não trocar essas credenciais durante a configuração, qualquer pessoa na internet que conhecer o padrão consegue fazer login e comprometer o dispositivo ou rede.

How to mitigate

Force a mudança de credenciais padrão na primeira execução, bloqueando acesso até que novas credenciais sejam definidas. Para sistemas já em produção, desative ou remova contas padrão e implemente senhas fortes geradas aleatoriamente para cada instalação, nunca documentadas em público.

CVE-2023-3703CRITICALProscend Advice ICR Series routers fw version 1.76EPSS 0.6%CVE-2025-0482MEDIUMFanli2012 native-php-cms user_recoverpwd.php default credentialsEPSS 0.6%CVE-2023-49621CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected aEPSS 0.6%CVE-2025-29521MEDIUMInsecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to EPSS 0.6%CVE-2025-34516CRITICALIlevia EVE X1 Server 4.7.18.0.eden Use of Default CredentialsEPSS 0.6%CVE-2024-54015HIGHA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9EPSS 0.6%CVE-2025-2398HIGHChina Mobile P22g-CIac CLI su Command default credentialsEPSS 0.6%CVE-2024-5245HIGHNETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation VulnerabilityEPSS 0.6%CVE-2024-7898MEDIUMTosei Online Store Management System ネット店舗管理システム Backend default credentialsEPSS 0.6%CVE-2024-7746CRITICALUse of default credentials at Traccar fleet management solutionEPSS 0.5%CVE-2024-6535MEDIUMSkupper: potential authentication bypass to skupper console via forged cookiesEPSS 0.5%CVE-2025-51536CRITICALAustrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.EPSS 0.5%CVE-2025-52997MEDIUMFile Browser Insecurely Handles PasswordsEPSS 0.5%CVE-2024-6788HIGHPhoenix Contact: update feature from CHARX controller can be used to reset a low privilege user passwordEPSS 0.5%CVE-2026-68503CRITICALLazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 DashboardEPSS 0.5%CVE-2026-44761CRITICALInsecure Sample Credentials in SAP Commerce CloudEPSS 0.5%CVE-2023-27573CRITICALnetbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef01234EPSS 0.5%CVE-2026-46386CRITICALOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`EPSS 0.5%CVE-2024-4622HIGHalpitronic Hypercharger EV Charger Use of Default CredentialsEPSS 0.5%CVE-2026-44159CRITICALTyler Identity Local (TID-L) default administrative credentialsEPSS 0.5%