CVE-2026-128910 is a vulnerability in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and associated 1300 communications board firmware versions 02.00.07.12 through 02.00.08.40. It involves the use of hard-coded credentials on the 1300 communications board, allowing an attacker with physical access to the board's serial console to log in as root. The password hash is identical across all units and uses DES crypt, enabling offline password recovery. No network login service accepts this password by default. The product is discontinued and no firmware fix is available.
Dell PowerScale InsightIQ versions 6.3.0 through 6.4.0 have a weakness in their password requirements that could allow an unauthenticated attacker with adjacent network access to gain unauthorized access and disclose sensitive information. This vulnerability is fixed in version 6.4.1 and later.
CVE-2026-41021 is a vulnerability in Eaton easyE4 caused by weak password requirements. This weakness allows an attacker who obtains password hashes, potentially via another vulnerability (CVE-2026-41020), to perform offline password-guessing attacks and recover user credentials. The issue affects versions prior to 2.46 and has been fixed in version 2.46.
SMP security request (from peripheral) does not include the maximum
encryption key size supported. Using a key with less than the maximum keysize
makes brute-forcing the key easier. See V6 in BLERP paper linked below.
CVE-2026-12504 is a high-severity improper authentication vulnerability in the PAM configuration of Loytec LIP-ME20xC devices and related products up to version 8.4.16 on LINX-A64. It allows a local attacker to authenticate as the root user without a password by exploiting an /etc/passwd entry with an empty password field, resulting in root shell access.
KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the use of any alphabetic, special, or extended characters.
This issue was fixed in the patch published in June 2026.
IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force attacks against user accounts, leading to unauthorized access to the targeted device.
An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.
A Weak Password Requirements vulnerability in the password management function of Juniper Networks CTP OS might allow an unauthenticated, network-based attacker to exploit weak passwords of local accounts and potentially take full control of the device.
The password management menu enables the administrator to set password complexity requirements, but these settings are not saved. The issue can be verified with the menu option "Show password requirements". Failure to enforce the intended requirements can lead to weak passwords being used, which significantly increases the likelihood that an attacker can guess these and subsequently attain unauthorized access.
This issue affects CTP OS versions 9.2R1 and 9.2R2.
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.
The web management interface of the device allows the administrator
username and password to be set to blank values. Once applied, the
device permits authentication with empty credentials over the web
management interface and Telnet service. This effectively disables
authentication across all critical management channels, allowing any
network-adjacent attacker to gain full administrative control without
credentials.
HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauthorized access
CVE-2025-68963 is a medium-severity vulnerability in Huawei's HarmonyOS version 4.3.1, caused by weak password requirements in the Clone module. This flaw enables a man-in-the-middle (MitM) attack that can compromise service confidentiality without impacting integrity or availability. Exploitation requires network-level access and some user interaction but no privileges. There are no known exploits in the wild, and no patches have been released yet. The vulnerability primarily threatens confidentiality by allowing attackers to intercept sensitive data during cloning operations. European organizations using HarmonyOS devices, especially those in sectors relying on Huawei technology, could be at risk. Mitigation involves enforcing stronger password policies, network segmentation, and monitoring for suspicious MitM activities. Countries with higher Huawei device adoption and strategic interest in Huawei technology, such as Germany, France, Italy, Spain, and the UK, are most likely affected.
Weak Password Requirements vulnerability in Apache Fineract.
This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0.
Users are encouraged to upgrade to version 1.13.0, the latest release.
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
A weak password policy vulnerability was identified in LibreNMS prior to version 25.11.0. This flaw allowed administrators to create accounts with very weak and predictable passwords, such as '12345678', increasing the risk of brute-force and credential stuffing attacks. The vulnerability has been fixed in version 25.11.0.
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may
allow an attacker to execute a brute-force attack resulting in
unauthorized access and login.
