Filtered by CWE-1391
Filtered by vendor Subscriptions
Total 37 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-6523 1 Devolutions 1 Devolutions Server 2025-10-08 7.7 High
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe. This issue affects the following versions : * Devolutions Server 2025.2.2.0 through 2025.2.3.0 * Devolutions Server 2025.1.11.0 and earlier
CVE-2024-52331 1 Ecovacs 28 Airbot Andy, Airbot Andy Firmware, Airbot Ava and 25 more 2025-10-02 7.5 High
ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.
CVE-2025-6077 1 Partner Software 2 Partner Software, Partner Web 2025-09-25 9.8 Critical
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.
CVE-2024-21865 2025-09-19 6.5 Medium
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may connect to the product via SSH and use a shell.
CVE-2025-30519 1 Doverfuelingsolutions 1 Progauge Maglink Lx Console 2025-09-19 9.8 Critical
Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system.
CVE-2024-42051 1 Splashtop 1 Streamer 2025-09-03 7.8 High
The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by replacing InstRegExp.reg.
CVE-2024-7558 1 Canonical 1 Juju 2025-08-26 8.7 High
JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.
CVE-2025-6737 1 Securden 1 Unified Pam 2025-08-26 7.2 High
Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.
CVE-2025-55584 1 Totolink 2 A3002r, A3002r Firmware 2025-08-21 5.3 Medium
TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account.
CVE-2025-35970 2025-08-08 7.5 High
On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege.
CVE-2025-52364 1 Tenda 2 Cp3 Pro, Cp3 Pro Firmware 2025-08-07 7.5 High
Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if default or weak credentials are present
CVE-2025-53558 1 Zte 2 Zxhn F660a, Zxhn F660t 2025-07-31 N/A
ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices.
CVE-2025-4057 1 Redhat 2 Amq Broker, Rhosemc 2025-07-31 5.5 Medium
A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
CVE-2024-51978 2025-07-25 9.8 Critical
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
CVE-2024-11717 1 Ctfd 1 Ctfd 2025-07-13 N/A
Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user's password and take over the account. Moreover, the tokens also include base64 encoded user email. This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679  included in 3.7.5 release.
CVE-2024-28066 1 Mitel 28 6905, 6905 Firmware, 6910 and 25 more 2025-06-18 8.8 High
In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
CVE-2023-48257 1 Bosch 21 Nexo-os, Nexo Cordless Nutrunner Nxa011s-36v-b \(0608842012\), Nexo Cordless Nutrunner Nxa011s-36v \(0608842011\) and 18 more 2025-06-17 7.8 High
The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticated users, by accessing already-exported backup packages, or crafting an import package and inducing an authenticated victim into sending the HTTP upload request.
CVE-2022-3010 1 Priva 1 Top Control Suite 2025-06-04 7.5 High
The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.
CVE-2025-32471 2025-04-29 3.7 Low
The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.
CVE-2024-29071 1 Kddi 1 Hgw Bli500hm Firmware 2025-03-28 8.8 High
HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.