Weaknesses of type CWE-1392

116 results

Uso de Credenciais Padrão

A aplicação ou serviço é implantado com credenciais (usuários, senhas, chaves) pré-configuradas e conhecidas publicamente, sem obrigar a mudança na primeira inicialização. Um atacante externo consegue acessar funcionalidades sensíveis usando essas credenciais padrão, contornando completamente o controle de acesso.

Example

Um roteador, câmera IP ou painel administrativo vem com user 'admin' e senha 'admin' ou '12345'. Se o usuário não trocar essas credenciais durante a configuração, qualquer pessoa na internet que conhecer o padrão consegue fazer login e comprometer o dispositivo ou rede.

How to mitigate

Force a mudança de credenciais padrão na primeira execução, bloqueando acesso até que novas credenciais sejam definidas. Para sistemas já em produção, desative ou remova contas padrão e implemente senhas fortes geradas aleatoriamente para cada instalação, nunca documentadas em público.

CVE-2024-28093HIGHThe TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level accountEPSS 0.5%CVE-2025-29629CRITICALGardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak defaEPSS 0.5%CVE-2025-8530MEDIUMelunez eladmin Druid application-prod.yml default credentialsEPSS 0.5%CVE-2026-27751CRITICALSODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default CredentialsEPSS 0.4%CVE-2025-7907MEDIUMyangzongzhuan RuoYi Druid application-druid.yml default credentialsEPSS 0.4%CVE-2024-12286CRITICALMOBATIME Network Master Clock has a use of default credentials vulnerabilityEPSS 0.4%CVE-2026-42072CRITICALNornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote accessEPSS 0.4%CVE-2025-51535CRITICALAustrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability.EPSS 0.4%CVE-2025-35042CRITICALAirship AI Acropolis default credentialsEPSS 0.4%CVE-2025-23012HIGHFedora Repository fedoraIntCallUser default credentialsEPSS 0.4%CVE-2025-10678CRITICALAdmin with default credentials in NetBird VPNEPSS 0.4%CVE-2022-50803CRITICALJM-DATA ONU JF511-TV 1.0.67 Default Credentials VulnerabilityEPSS 0.4%CVE-2025-30139CRITICALAn issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with deEPSS 0.4%CVE-2026-3144HIGHIBM API Connect Default CredentialsEPSS 0.4%CVE-2025-59108CRITICALWeak Default Passwords in dormakaba access managerEPSS 0.4%CVE-2023-43844HIGHAten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not asked to change the credeEPSS 0.4%CVE-2026-22886CRITICALOpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a defaulEPSS 0.4%CVE-2024-31069HIGHIOSIX IO-1020 Micro ELD Use of Default CredentialsEPSS 0.4%CVE-2026-78573CRITICALIBM ContextForge MCP Gateway is affected by use of default credentialsEPSS 0.4%CVE-2018-25147CRITICALMicrohard Systems IPn4G 1.1.0 Default Credentials Authentication BypassEPSS 0.4%