Weaknesses of type CWE-1393

49 results

Uso de Senha Padrão

A aplicação ou dispositivo é distribuído com uma senha padrão conhecida e o desenvolvedor não força sua alteração obrigatória na primeira inicialização. Um atacante pode usar essa senha pública para acessar funções administrativas ou sensíveis sem autenticação legítima.

Example

Um roteador é vendido com usuário 'admin' e senha 'admin123'. Se o firmware não obriga troca na primeira conexão, qualquer pessoa na rede consegue acessar as configurações e redirecionar tráfego ou desabilitar segurança.

How to mitigate

Force alteração obrigatória de credenciais padrão no primeiro acesso (setup wizard). Não distribua documentação com senhas padrão em produção e, se usar credenciais de fábrica, gere-as únicas por dispositivo ou nunca permita acesso remoto sem mudança prévia.

CVE-2025-27690CRITICALDell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker withEPSS 0.5%CVE-2026-5269CRITICALNavigator NCS and MCP System Accounts with Default PasswordsEPSS 0.5%CVE-2026-16504CRITICALVPS.org one-click Zulip template deployment instance contains multiple vulnerabilitiesEPSS 0.5%CVE-2026-33784CRITICALJSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged accessEPSS 0.5%CVE-2024-49559HIGHDell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. A loEPSS 0.5%CVE-2026-35075CRITICALHardcoded default Password for Service AccountEPSS 0.5%CVE-2025-26701CRITICALAn issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use EPSS 0.5%CVE-2026-22886CRITICALOpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a defaulEPSS 0.5%CVE-2026-16503CRITICALVPS.org one-click Supabase template deployment instance contains multiple vulnerabilitiesEPSS 0.4%CVE-2026-24429CRITICALTenda W30E V2 Hardcoded Default Password for Built-in AccountEPSS 0.4%CVE-2024-51555CRITICALForce Change of Default CredentialsEPSS 0.4%CVE-2025-14917MEDIUMIBM WebSphere Application Server Liberty could provide weaker than expected securityEPSS 0.4%CVE-2024-13966MEDIUMZKTeco BioTime default passwordEPSS 0.4%CVE-2025-66050CRITICALNo password set for administrative account in Vivotek IP7137 camerasEPSS 0.4%CVE-2026-121022CRITICALDefault Administrator Password Change Not Enforced in Axxon One Web ClientEPSS 0.4%CVE-2025-2766HIGH70mai A510 Use of Default Password Authentication Bypass VulnerabilityEPSS 0.4%CVE-2025-2921MEDIUMNetis WF-2404 passwd default passwordEPSS 0.4%CVE-2026-19851HIGHUse of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5EPSS 0.3%CVE-2026-54445MEDIUMVantage6: Set admin user and password from environment or configurationEPSS 0.3%CVE-2024-36440MEDIUMAn issue was discovered on Swissphone DiCal-RED 4009 devices. An attacker with access to the file /etc/deviceconfig may recover the administEPSS 0.3%