Common Weakness Enumeration
Show details on NVD website
Show details on NVD website
Show details on NVD website
Back to CWE stats page
CWE-1393
Use of Default Password
The product uses default passwords for potentially critical functionality.
CVE-2026-35075 (GCVE-0-2026-35075)
Vulnerability from cvelistv5 – Published: 2026-06-03 10:38 – Updated: 2026-06-09 10:38
VLAI
Title
Hardcoded default Password for Service Account
Summary
An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-1393 - Use of Default Password
Assigner
References
1 reference
Impacted products
18 products
| Vendor | Product | Version | |
|---|---|---|---|
| MBS | Single-A |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-A Profibus |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-A x-link |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Single-X |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X CAN |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X DALI |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X KNX |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X LON |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X M-Bus |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X PROFINET |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Double-X x-link |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X KNX+DALI |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X KNX+LON |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X KNX+M-Bus |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X PROFINET+DALI |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X PROFINET+KNX |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X PROFINET+LON |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
|
| MBS | Triple-X PROFINET+M-Bus |
Affected:
V1_0_0_0 , < V6_0_0_7
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-03T12:39:57.652546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T12:41:59.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Single-A",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A Profibus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-A x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single-X",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X CAN",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X PROFINET",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Double-X x-link",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X KNX+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+DALI",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+KNX",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+LON",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Triple-X PROFINET+M-Bus",
"vendor": "MBS",
"versions": [
{
"lessThan": "V6_0_0_7",
"status": "affected",
"version": "V1_0_0_0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_a_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_profibus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_a_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:single_x_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_can_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_profinet_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:double_x_x_link_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_knx_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_dali_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_knx_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_lon_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mbs:triple_x_profinet_m_bus_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "V6_0_0_7",
"versionStartIncluding": "V1_0_0_0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adrien Rey from Armasuisse Cyber-Defence campus"
},
{
"lang": "en",
"type": "finder",
"value": "Daniel Hulliger from Armasuisse Cyber-Defence campus"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices. \u003c/p\u003e"
}
],
"value": "An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393 Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T10:38:45.361Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2026-039/"
}
],
"source": {
"advisory": "VDE-2026-039",
"defect": [
"CERT@VDE#642009"
],
"discovery": "UNKNOWN"
},
"title": "Hardcoded default Password for Service Account",
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2026-35075",
"datePublished": "2026-06-03T10:38:23.515Z",
"dateReserved": "2026-04-01T08:28:27.141Z",
"dateUpdated": "2026-06-09T10:38:45.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54445 (GCVE-0-2026-54445)
Vulnerability from cvelistv5 – Published: 2026-06-17 22:14 – Updated: 2026-06-18 15:49
VLAI
Title
Vantage6: Set admin user and password from environment or configuration
Summary
vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/vantage6/vantage6/security/adv… | x_refsource_CONFIRM |
| https://github.com/vantage6/vantage6/issues/1932 | x_refsource_MISC |
| https://github.com/vantage6/vantage6/blob/main/do… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T15:49:25.888301Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T15:49:54.097Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "vantage6",
"vendor": "vantage6",
"versions": [
{
"status": "affected",
"version": "\u003c 5.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "vantage6 is an open-source infrastructure for privacy preserving analysis. Versions prior to 5.0.0 provide an initial user with username `root` and password `root`. This is not ideal because attackers know that almost all vantage6 servers have a user with username `root` that probably has admin rights, and the initial password is very weak and it is possible that administrators forget to reset it. Version 5.0.0 fixes the issue. As a workaround, it is possible to delete the `root` user after it has been used to create other users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393: Use of Default Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T22:14:51.461Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/vantage6/vantage6/security/advisories/GHSA-fgmc-2hqj-86v4"
},
{
"name": "https://github.com/vantage6/vantage6/issues/1932",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vantage6/vantage6/issues/1932"
},
{
"name": "https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500"
}
],
"source": {
"advisory": "GHSA-fgmc-2hqj-86v4",
"discovery": "UNKNOWN"
},
"title": "Vantage6: Set admin user and password from environment or configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54445",
"datePublished": "2026-06-17T22:14:51.461Z",
"dateReserved": "2026-06-15T15:30:40.317Z",
"dateUpdated": "2026-06-18T15:49:54.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8672 (GCVE-0-2026-8672)
Vulnerability from cvelistv5 – Published: 2026-05-22 13:17 – Updated: 2026-05-22 15:04
VLAI
Title
Default credentials for internal DB
Summary
Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords.
This issue affects Avantra: before 25.3.0.
Severity
5.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1393 - Use of default password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.avantra.com/hc/en-us/articles/553… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| syslink software AG | Avantra |
Affected:
0 , < 25.3.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8672",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-22T15:04:21.729145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T15:04:30.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Windows"
],
"product": "Avantra",
"vendor": "syslink software AG",
"versions": [
{
"lessThan": "25.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vicxer Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords.\u003cp\u003eThis issue affects Avantra: before 25.3.0.\u003c/p\u003e"
}
],
"value": "Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords.\n\nThis issue affects Avantra: before 25.3.0."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1393",
"description": "CWE-1393 Use of default password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-22T13:17:05.199Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.avantra.com/hc/en-us/articles/5535551609759"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Default credentials for internal DB",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-8672",
"datePublished": "2026-05-22T13:17:05.199Z",
"dateReserved": "2026-05-15T11:49:59.333Z",
"dateUpdated": "2026-05-22T15:04:30.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Phase: Requirements
Description:
- Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Mitigation
Phase: Documentation
Description:
- Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
Mitigation
Phase: Architecture and Design
Description:
- Force the administrator to change the credential upon installation.
Mitigation
Phases: Installation, Operation
Description:
- The product administrator could change the defaults upon installation or during operation.
No CAPEC attack patterns related to this CWE.