Fallos del tipo CWE-1392

116 resultados

Uso de credenciais padrão

A aplicação ou sistema é instalado ou deployado com credenciais (usuário e senha) pré-configuradas que nunca são alteradas. Um atacante consegue acessar a aplicação ou recurso usando essas credenciais conhecidas publicamente, contornando completamente autenticação e controle de acesso.

Ejemplo

Um roteador ou câmera IP sai da fábrica com login admin/admin. Se o responsável não trocar a senha no setup, qualquer pessoa que conhece essas credenciais padrão (fácil de achar em manual ou fórum) consegue acessar e reconfigurar o dispositivo.

Cómo mitigar

Force alteração de credenciais padrão durante o primeiro acesso ou setup inicial — bloqueie qualquer operação além da autenticação até que a senha seja trocada. Em ambiente corporativo, use gestão centralizada de credenciais e audite regularmente contas com padrões conhecidos.

CVE-2023-3703CRITICALProscend Advice ICR Series routers fw version 1.76EPSS 0.6%CVE-2025-0482MEDIUMFanli2012 native-php-cms user_recoverpwd.php default credentialsEPSS 0.6%CVE-2023-49621CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected aEPSS 0.6%CVE-2025-29521MEDIUMInsecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to EPSS 0.6%CVE-2025-34516CRITICALIlevia EVE X1 Server 4.7.18.0.eden Use of Default CredentialsEPSS 0.6%CVE-2024-54015HIGHA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP300) (All versions >= V8.80 < V9EPSS 0.6%CVE-2025-2398HIGHChina Mobile P22g-CIac CLI su Command default credentialsEPSS 0.6%CVE-2024-5245HIGHNETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation VulnerabilityEPSS 0.6%CVE-2024-7898MEDIUMTosei Online Store Management System ネット店舗管理システム Backend default credentialsEPSS 0.6%CVE-2024-7746CRITICALUse of default credentials at Traccar fleet management solutionEPSS 0.5%CVE-2024-6535MEDIUMSkupper: potential authentication bypass to skupper console via forged cookiesEPSS 0.5%CVE-2025-51536CRITICALAustrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.EPSS 0.5%CVE-2025-52997MEDIUMFile Browser Insecurely Handles PasswordsEPSS 0.5%CVE-2024-6788HIGHPhoenix Contact: update feature from CHARX controller can be used to reset a low privilege user passwordEPSS 0.5%CVE-2026-68503CRITICALLazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 DashboardEPSS 0.5%CVE-2026-44761CRITICALInsecure Sample Credentials in SAP Commerce CloudEPSS 0.5%CVE-2023-27573CRITICALnetbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef01234EPSS 0.5%CVE-2026-46386CRITICALOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`EPSS 0.5%CVE-2024-4622HIGHalpitronic Hypercharger EV Charger Use of Default CredentialsEPSS 0.5%CVE-2026-44159CRITICALTyler Identity Local (TID-L) default administrative credentialsEPSS 0.5%