CWE-1391 vulnerabilities

The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.

Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system.

Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions.

CVE-2025-6523 is a critical vulnerability in Devolutions Server's emergency authentication component, caused by the use of weak credentials. It allows unauthenticated attackers to bypass authentication by brute forcing short emergency codes within a feasible timeframe. Affected versions include Devolutions Server 2025.1.11.0 and earlier, up to 2025.2.3.0. The vulnerability has a CVSS score of 9.

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.

ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot.

CVE-2024-11717 is a vulnerability in CTFd up to version 3.7.4 where account activation and password reset tokens can be used interchangeably and are not single-use. These tokens are sent as GET parameters and include base64 encoded user emails. An attacker on the network path could reuse a token during its validity period to change a user's password and take over the account. The issue was fixed in version 3.7.5.

The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.