Fallos del tipo CWE-1392

135 resultados

Uso de credenciais padrão

A aplicação ou sistema é instalado ou deployado com credenciais (usuário e senha) pré-configuradas que nunca são alteradas. Um atacante consegue acessar a aplicação ou recurso usando essas credenciais conhecidas publicamente, contornando completamente autenticação e controle de acesso.

Ejemplo

Um roteador ou câmera IP sai da fábrica com login admin/admin. Se o responsável não trocar a senha no setup, qualquer pessoa que conhece essas credenciais padrão (fácil de achar em manual ou fórum) consegue acessar e reconfigurar o dispositivo.

Cómo mitigar

Force alteração de credenciais padrão durante o primeiro acesso ou setup inicial — bloqueie qualquer operação além da autenticação até que a senha seja trocada. Em ambiente corporativo, use gestão centralizada de credenciais e audite regularmente contas com padrões conhecidos.

CVE-2026-1803CRITICALZiroom ZHOME A0101 Dropbear SSH Service default credentialsEPSS 0.7%CVE-2026-1972MEDIUMEdimax BR-6208AC auth_check_userpass2 default credentialsEPSS 0.7%CVE-2025-0482MEDIUMFanli2012 native-php-cms user_recoverpwd.php default credentialsEPSS 0.7%CVE-2024-29844CRITICALDefault credentials on web interface of Evolution Controller Versions allows attackers to login and perform administrative functionsEPSS 0.6%CVE-2023-3703CRITICALProscend Advice ICR Series routers fw version 1.76EPSS 0.6%CVE-2025-51536CRITICALAustrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.EPSS 0.6%CVE-2023-49621CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected aEPSS 0.6%CVE-2025-2398HIGHChina Mobile P22g-CIac CLI su Command default credentialsEPSS 0.6%CVE-2025-29521MEDIUMInsecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to EPSS 0.6%CVE-2025-34516CRITICALIlevia EVE X1 Server 4.7.18.0.eden Use of Default CredentialsEPSS 0.6%CVE-2024-54015HIGHA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9EPSS 0.6%CVE-2026-78573CRITICALIBM ContextForge MCP Gateway is affected by use of default credentialsEPSS 0.6%CVE-2024-5245HIGHNETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation VulnerabilityEPSS 0.6%CVE-2023-27573CRITICALnetbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef01234EPSS 0.6%CVE-2025-8530MEDIUMelunez eladmin Druid application-prod.yml default credentialsEPSS 0.6%CVE-2024-7898MEDIUMTosei Online Store Management System ネット店舗管理システム Backend default credentialsEPSS 0.6%CVE-2026-86464CRITICALIn the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM) deploEPSS 0.5%CVE-2026-90940MEDIUMnovel-plus through 5.3.3 Default Cache Management Password in the Front PortalEPSS 0.5%CVE-2025-52997MEDIUMFile Browser Insecurely Handles PasswordsEPSS 0.5%CVE-2026-112354CRITICALEtrel INCH AC Charging Station Hard-coded Default CredentialsEPSS 0.5%