# CWE-1392.

Every Advisory and CVE whose sources give the weakness CWE-1392, newest first.

## Records, newest first

- [IRISPowerscan Default accounts with predictable credentials](https://agentprime.io/advisories/CVE-2026-94459.md)
  `CVE-2026-94459` · CVE record: I.R.I.S S.A. IRISPowerscan · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-1392
- [Etrel INCH AC Charging Station Hard-coded Default Credentials](https://agentprime.io/advisories/CVE-2026-112354.md)
  `CVE-2026-112354` · CVE record: Etrel d.o.o. Etrel INCH · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1392
- [Use of default password based on serial number](https://agentprime.io/advisories/CVE-2026-22105.md)
  `CVE-2026-22105` · CVE record: Delta Electronics Delta UFC500 · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-1392
- [Default WebUI passwords stored in plaintext](https://agentprime.io/advisories/CVE-2026-22109.md)
  `CVE-2026-22109` · CVE record: Delta Electronics Delta UFC500 · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-1392
- [Use of Default Credentials in boneIO](https://agentprime.io/advisories/CVE-2026-77056.md)
  `CVE-2026-77056` · CVE record: boneIO black_debian_images · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-1392
- [OpenThread joiner autostart uses a publicly documented default Joining Device Credential (PSKd)](https://agentprime.io/advisories/CVE-2026-19741.md)
  `CVE-2026-19741` · CVE record: zephyrproject zephyr · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-1392
- [Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass](https://agentprime.io/advisories/CVE-2026-55457.md)
  `CVE-2026-55457` · CVE record: intranda goobi-viewer-core · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1392
- [DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment](https://agentprime.io/advisories/CVE-2026-77933.md)
  `CVE-2026-77933` · CVE record: eosphoros-ai DB-GPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1392
- [FlyCms through commit edfdf724 Default Super Administrator Credentials](https://agentprime.io/advisories/CVE-2026-112296.md)
  `CVE-2026-112296` · CVE record: sunkaifei FlyCms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-1392
- [Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway](https://agentprime.io/advisories/CVE-2026-111998.md)
  `CVE-2026-111998` · CVE record: vanus-labs vanus · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-1392
- [DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials](https://agentprime.io/advisories/CVE-2026-111693.md)
  `CVE-2026-111693` · CVE record: databufflabs databuff · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-1392
- [JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console](https://agentprime.io/advisories/CVE-2026-111329.md)
  `CVE-2026-111329` · CVE record: juggleim JuggleIM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1392
- [PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials](https://agentprime.io/advisories/CVE-2026-108783.md)
  `CVE-2026-108783` · CVE record: PRVTPRO Amnezia-Web-Panel · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-1392
- [Astron Agent: Unsandboxed code-node leads to cross-tenant RCE](https://agentprime.io/advisories/CVE-2026-108263.md)
  `CVE-2026-108263` · CVE record: iflytek astron-agent · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection, Authentication bypass, Broken access control, CWE-653
- [Authentication bypass via default auth token in P4Search](https://agentprime.io/advisories/CVE-2026-100103.md)
  `CVE-2026-100103` · CVE record: Perfoce P4 (Helix Core) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-1392
- [Default Admin Credentials in Innotim Software's Logsign SIEM](https://agentprime.io/advisories/CVE-2026-90924.md)
  `CVE-2026-90924` · CVE record: Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-1392
- [X-SpringBoot through 6.0 Authentication Bypass via Static Master Code](https://agentprime.io/advisories/CVE-2026-97064.md)
  `CVE-2026-97064` · CVE record: yzcheng90 X-SpringBoot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-1392
- [ningzichun student-management-system example_lite.sql default credentials](https://agentprime.io/advisories/CVE-2026-97649.md)
  `CVE-2026-97649` · CVE record: ningzichun student-management-system · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-1392
- [novel-plus through 5.3.3 Default Cache Management Password in the Front Portal](https://agentprime.io/advisories/CVE-2026-90940.md)
  `CVE-2026-90940` · CVE record: 201206030 novel-plus · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-1392
- [lenve vhr vhr.sql default credentials](https://agentprime.io/advisories/CVE-2026-90498.md)
  `CVE-2026-90498` · CVE record: lenve vhr · CVSS 6.9 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-1392
- [Use of default credentials in Malcolm](https://agentprime.io/advisories/CVE-2026-90456.md)
  `CVE-2026-90456` · CVE record: CISA Malcolm · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-1392
- [Use of Default Credentials in Malcolm](https://agentprime.io/advisories/CVE-2026-90451.md)
  `CVE-2026-90451` · CVE record: CISA Malcolm · CVSS 8.2 High · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-1392
- [IBM ContextForge MCP Gateway is affected by use of default credentials](https://agentprime.io/advisories/CVE-2026-78573.md)
  `CVE-2026-78573` · CVE record: IBM ContextForge MCP Gateway · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-1392
- [Information disclosure in Eclipse Foundation Eclipse aeriOS](https://agentprime.io/advisories/CVE-2026-86464.md)
  `CVE-2026-86464` · CVE record: Eclipse Foundation Eclipse aeriOS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials, CWE-1188
- [Datiphy Data Management Center - Use of Default Credentials](https://agentprime.io/advisories/CVE-2026-76155.md)
  `CVE-2026-76155` · CVE record: Datiphy Inc. Data Management Center · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-1392
- [GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)](https://agentprime.io/advisories/GHSA-p77j-g7h5-r2vw.md)
  `GHSA-p77j-g7h5-r2vw` · PyPI `geolens`: affected `<1.2.4`, fixed in `1.2.4` · No CVSS score · Not analysed yet · Published 19 Aug 2026 · Tags: Other injection, Information disclosure, Broken access control, Denial of service
- [Use of hard-coded VNC credentials in the engineering-workstation provisioning](https://agentprime.io/advisories/CVE-2026-65313.md)
  `CVE-2026-65313` · CVE record: ANDRITZ HIPASE-250 and 1 more · CVSS 8.1 High · Not analysed yet · Published 31 Jul 2026 · Tags: Hard-coded credentials, CWE-1392
- [LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard](https://agentprime.io/advisories/CVE-2026-68503.md)
  `CVE-2026-68503` · CVE record: grisuno LazyOwn · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-1392
- [Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly](https://agentprime.io/advisories/CVE-2026-41939.md)
  `CVE-2026-41939` · CVE record: Care Everywhere LLC Care Everywhere Gateway · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-1392
- [Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password](https://agentprime.io/advisories/GHSA-f25v-x6vr-962g.md)
  `GHSA-f25v-x6vr-962g`, `PKSA-jw7m-7sxt-c8zt` · Packagist `pheditor/pheditor`: affected `<2.0.8`, fixed in `2.0.8` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-1392
- [Insecure Sample Credentials in SAP Commerce Cloud](https://agentprime.io/advisories/CVE-2026-44761.md)
  `CVE-2026-44761` · CVE record: SAP_SE SAP Commerce Cloud · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1392
- [IBM API Connect Default Credentials](https://agentprime.io/advisories/CVE-2026-3144.md)
  `CVE-2026-3144` · CVE record: IBM API Connect · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-1392
- [AutoBangumi < 3.2.8 - Hard-coded Default Credentials via add_default_user()](https://agentprime.io/advisories/CVE-2026-58466.md)
  `CVE-2026-58466` · CVE record: EstrellaXD Auto_Bangumi · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-1392
- [JAIOTlink C492A-W6 4.8.30.57701411 Hard-coded Credentials via anyka_ipc](https://agentprime.io/advisories/CVE-2026-58453.md)
  `CVE-2026-58453` · CVE record: JAIOTlink C492A-W6 Wi-Fi IP Camera · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-1392
- [OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default \`SECRET_KEY_BASE=OVERWRITE_ME\` and \`cookies_serializer = :marshal\`](https://agentprime.io/advisories/CVE-2026-46386.md)
  `CVE-2026-46386` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization, Hard-coded credentials, CWE-1188, CWE-1392
- [Dell Wyse Management Suite (WMS): Dell Wyse Management Suite (WMS), versions prior to WMS 2605…](https://agentprime.io/advisories/CVE-2026-44273.md)
  `CVE-2026-44273` · CVE record: Dell Wyse Management Suite (WMS) · CVSS 6.0 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-1392
- [Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability.](https://agentprime.io/advisories/CVE-2026-32652.md)
  `CVE-2026-32652` · CVE record: Dell AIOps · CVSS 7.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-1392
- [Brickcom Cameras Use of Default Credentials](https://agentprime.io/advisories/CVE-2026-50005.md)
  `CVE-2026-50005` · CVE record: Brickcom Cube and 3 more · CVSS 8.3 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-1392
- [Vulnerability in navify® Digital Pathology](https://agentprime.io/advisories/CVE-2026-9844.md)
  `CVE-2026-9844` · CVE record: Roche Diagnostics navify Digital Pathology · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-1392
- [MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials](https://agentprime.io/advisories/CVE-2026-42941.md)
  `CVE-2026-42941` · CVE record: Danelec MacGregor Voyage Data Recorder (VDR) G4e · CVSS 8.7 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-1392
- [RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation](https://agentprime.io/advisories/CVE-2026-45039.md)
  `CVE-2026-45039` · CVE record: rustfs rustfs · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Hard-coded credentials, CWE-1392
- [IBM Operations Analytics - Log Analysis is affected by Information disclosure due to default passwords not being forced to be changed on post-installation](https://agentprime.io/advisories/CVE-2026-7365.md)
  `CVE-2026-7365` · CVE record: IBM Operations Analytics - Log Analysis · CVSS 8.4 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-1392
- [Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - Cyclops.](https://agentprime.io/advisories/CVE-2025-36221.md)
  `CVE-2025-36221` · CVE record: IBM Cloud Pak for Data System - Cyclops · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-1392
- [Tyler Identity Local (TID-L) default administrative credentials](https://agentprime.io/advisories/CVE-2026-44159.md)
  `CVE-2026-44159` · CVE record: Tyler Technologies TID-L · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: CWE-1392
- [Insecure default administrative credentials in AlloyDB for PostgreSQL](https://agentprime.io/advisories/CVE-2026-7428.md)
  `CVE-2026-7428` · CVE record: Google Cloud AlloyDB for PostgreSQL · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: CWE-1392
- [NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access](https://agentprime.io/advisories/GHSA-2hp7-65r3-wv54.md)
  `GHSA-2hp7-65r3-wv54`, `CVE-2026-42072`, `GO-2026-4967` · Go `github.com/orneryd/nornicdb`: affected `<1.0.42-hotfix`, fixed in `1.0.42-hotfix` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-1392
- [netbox-community netbox-docker: netbox-docker before 2.5.0 has a superuser account with default credentials (admin…](https://agentprime.io/advisories/CVE-2023-27573.md)
  `CVE-2023-27573` · CVE record: netbox-community netbox-docker · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-1392
- [Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.](https://agentprime.io/advisories/CVE-2026-31837.md)
  `CVE-2026-31837` · CVE record: istio istio · CVSS 8.7 High · Not analysed yet · Published 10 Mar 2026 · Tags: Information disclosure, CWE-1392
- [Default credentials set for local privileged user in Virtual Appliance.](https://agentprime.io/advisories/CVE-2026-28713.md)
  `CVE-2026-28713` · CVE record: Acronis Acronis Cyber Protect Cloud Agent and 1 more · CVSS 7.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-1392
- [Weak credentials in Eclipse Foundation Eclipse OpenMQ](https://agentprime.io/advisories/CVE-2026-22886.md)
  `CVE-2026-22886` · CVE record: Eclipse Foundation Eclipse OpenMQ · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials, CWE-1392, CWE-1393
- [SODOLA SL902-SWTGW124AS <= 200.1.20 Use of Default Credentials](https://agentprime.io/advisories/CVE-2026-27751.md)
  `CVE-2026-27751` · CVE record: Shenzhen Hongyavision Technology Co., Ltd. (Sodola Networks) SODOLA SL902-SWTGW124AS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-1392
- [Tattile Smart+ / Vega / Basic <= 1.181.5 Default Credentials](https://agentprime.io/advisories/CVE-2026-26341.md)
  `CVE-2026-26341` · CVE record: Tattile s.r.l. Smart+ and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-1392
- [JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials](https://agentprime.io/advisories/CVE-2026-26366.md)
  `CVE-2026-26366` · CVE record: JUNG eNet SMART HOME server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Feb 2026 · Tags: CWE-1392
- [BrightSign Players Use of Default Credentials](https://agentprime.io/advisories/CVE-2025-54756.md)
  `CVE-2025-54756` · CVE record: BrightSign BrightSign OS series 4 players and 1 more · CVSS 8.6 High · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-1392
- [Edimax BR-6208AC auth_check_userpass2 default credentials](https://agentprime.io/advisories/CVE-2026-1972.md)
  `CVE-2026-1972` · CVE record: Edimax BR-6208AC · CVSS 6.9 Medium · Not analysed yet · Published 6 Feb 2026 · Tags: CWE-1392
- [Ziroom ZHOME A0101 Dropbear SSH Service default credentials](https://agentprime.io/advisories/CVE-2026-1803.md)
  `CVE-2026-1803` · CVE record: Ziroom ZHOME A0101 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-1392
- [Use of default credentials vulnerability in Hitachi Energy SuprOS product](https://agentprime.io/advisories/CVE-2025-7740.md)
  `CVE-2025-7740` · CVE record: Hitachi Energy SuprOS · CVSS 8.8 High · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-1392
- [Weak Default Passwords in dormakaba access manager](https://agentprime.io/advisories/CVE-2025-59108.md)
  `CVE-2025-59108` · CVE record: dormakaba Access Manager 92xx-k5 and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-1392
- [Dell ObjectScale: Dell ECS, versions 3.8.1.0 through 3.8.1.7…](https://agentprime.io/advisories/CVE-2026-22273.md)
  `CVE-2026-22273` · CVE record: Dell ObjectScale · CVSS 8.8 High · Not analysed yet · Published 23 Jan 2026 · Tags: CWE-1392
- [Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture](https://agentprime.io/advisories/CVE-2025-58744.md)
  `CVE-2025-58744` · CVE record: Milner ImageDirector Capture · CVSS 6.9 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Hard-coded credentials, CWE-1392

Older: <https://agentprime.io/advisories/tag/cwe-1392.md?cursor=WyIyMDI2LTAxLTIwVDIxOjM4OjAyLjM2MTAwMFoiLCJDVkUtMjAyNS01ODc0NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1392>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1392/>. Everything for agents: <https://agentprime.io/llms.txt>.