CVE-2026-121022High· 8.1▾ TwilightUse of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly instal…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
axxon_one < 3.0.0Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.
On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121021Medium· 5.5Plaintext Storage of LDAP Password in Axxon One Shared Configuration
CVE-2026-121020Medium· 4.3User and Role Enumeration by Low-Privileged Users in Axxon One Security Configuration API
CVE-2026-121024Medium· 5.4Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
CVE-2026-121023Medium· 5.5LDAP Bind Password Exposure in AxxonNet ARP Agent Logs
CVE-2026-112030Medium· 6.3diem-project diem dmDataLoad.php default password
CVE-2026-16755Medium· 5.3A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.