Weaknesses of type CWE-1392

137 results

Uso de Credenciais Padrão

A aplicação ou serviço é implantado com credenciais (usuários, senhas, chaves) pré-configuradas e conhecidas publicamente, sem obrigar a mudança na primeira inicialização. Um atacante externo consegue acessar funcionalidades sensíveis usando essas credenciais padrão, contornando completamente o controle de acesso.

Example

Um roteador, câmera IP ou painel administrativo vem com user 'admin' e senha 'admin' ou '12345'. Se o usuário não trocar essas credenciais durante a configuração, qualquer pessoa na internet que conhecer o padrão consegue fazer login e comprometer o dispositivo ou rede.

How to mitigate

Force a mudança de credenciais padrão na primeira execução, bloqueando acesso até que novas credenciais sejam definidas. Para sistemas já em produção, desative ou remova contas padrão e implemente senhas fortes geradas aleatoriamente para cada instalação, nunca documentadas em público.

CVE-2026-1803CRITICALZiroom ZHOME A0101 Dropbear SSH Service default credentialsEPSS 0.7%CVE-2026-1972MEDIUMEdimax BR-6208AC auth_check_userpass2 default credentialsEPSS 0.7%CVE-2025-0482MEDIUMFanli2012 native-php-cms user_recoverpwd.php default credentialsEPSS 0.7%CVE-2024-29844CRITICALDefault credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functionsEPSS 0.6%CVE-2023-3703CRITICALProscend Advice ICR Series routers fw version 1.76EPSS 0.6%CVE-2025-51536CRITICALAustrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.EPSS 0.6%CVE-2023-49621CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected aEPSS 0.6%CVE-2025-2398HIGHChina Mobile P22g-CIac CLI su Command default credentialsEPSS 0.6%CVE-2025-29521MEDIUMInsecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to EPSS 0.6%CVE-2025-34516CRITICALIlevia EVE X1 Server 4.7.18.0.eden Use of Default CredentialsEPSS 0.6%CVE-2024-54015HIGHA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9EPSS 0.6%CVE-2026-78573CRITICALIBM ContextForge MCP Gateway is affected by use of default credentialsEPSS 0.6%CVE-2024-5245HIGHNETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation VulnerabilityEPSS 0.6%CVE-2023-27573CRITICALnetbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef01234EPSS 0.6%CVE-2025-8530MEDIUMelunez eladmin Druid application-prod.yml default credentialsEPSS 0.6%CVE-2024-7898MEDIUMTosei Online Store Management System ネット店舗管理システム Backend default credentialsEPSS 0.6%CVE-2026-90940MEDIUMnovel-plus through 5.3.3 Default Cache Management Password in the Front PortalEPSS 0.5%CVE-2026-86464CRITICALIn the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deploEPSS 0.5%CVE-2025-52997MEDIUMFile Browser Insecurely Handles PasswordsEPSS 0.5%CVE-2026-112354CRITICALEtrel INCH AC Charging Station Hard-coded Default CredentialsEPSS 0.5%