{"id":"CVE-2026-121022","title":"Default Administrator Password Change Not Enforced in Axxon One Web Client","summary":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly instal…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-1393"],"vendor":"AxxonSoft","product":"Axxon One","affected":["axxon_one < 3.0.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-11-03T20:16:24.186791Z"},"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:16:40.100Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121022","references":[{"url":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022"}],"tags":["cve.org"],"epss":0.00378,"epssPercentile":0.32025,"ingestedAt":"2026-11-05T20:33:06.438Z","slug":"CVE-2026-121022","body":"## Overview\n\nUse of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.\n\n## Affected\n\n- `axxon_one < 3.0.0`\n\n## Remediation\n\nUpgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.\n\n### Workarounds\n\nOn earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}