CVE-2026-121022criticalCWE-1393

CVE-2026-121022: falha crítica em AxxonSoft Axxon One

Default Administrator Password Change Not Enforced in Axxon One Web Client

Publicada em

Seguir esta CVE+ Monitorar Axxon One

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.4%
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
AxxonSoft · Axxon One
CVEs relacionadas — AxxonSoft Axxon One

No mesmo produto, das mais perigosas para as menos.

CVE-2026-121020MEDIUMUser and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration APIEPSS 0.2%CVE-2026-121021MEDIUMPlaintext Storage of LDAP Password in Axxon One Shared ConfigurationEPSS 0.1%