{"id":"CVE-2026-121022","state":"PUBLISHED","title":"Default Administrator Password Change Not Enforced in Axxon One Web Client","description":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.","publishedAt":"2026-11-03T08:46:13.492Z","updatedAt":"2026-11-03T08:46:13.492Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"AxxonSoft"},"assigner":"AxxonSoft","products":["AxxonSoft Axxon One"],"affected":[{"vendor":"AxxonSoft","product":"Axxon One","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.0.0","versionType":"semver"}],"platforms":["Windows","Linux"]}],"references":["https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022"],"weaknesses":["CWE-1393"],"ingestedAt":"2026-11-03T08:48:06.237Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/121xxx/CVE-2026-121022.json","commit":"624e0df12c07ecda8abb20a2712f3f0aa4cd762f","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121022","state":"PUBLISHED","datePublished":"2026-11-03T08:46:13.492Z","dateUpdated":"2026-11-03T08:46:13.492Z","assignerShortName":"AxxonSoft","assignerOrgId":"15ede60e-6fda-426e-be9c-e788f151a377","dateReserved":"2026-11-03T08:40:19.154Z"},"containers":{"cna":{"title":"Default Administrator Password Change Not Enforced in Axxon One Web Client","descriptions":[{"lang":"en","value":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login."}],"affected":[{"vendor":"AxxonSoft","product":"Axxon One","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.0.0","versionType":"semver"}],"platforms":["Windows","Linux"]}],"references":[{"url":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1393","lang":"en","description":"CWE-1393 Use of Default Password","type":"CWE"}]}],"providerMetadata":{"shortName":"AxxonSoft","orgId":"15ede60e-6fda-426e-be9c-e788f151a377","dateUpdated":"2026-11-03T08:46:13.492Z"},"impacts":[{"capecId":"CAPEC-70","descriptions":[{"lang":"en","value":"CAPEC-70 Try Common or Default Usernames and Passwords"}]}],"workarounds":[{"lang":"en","value":"On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.","supportingMedia":[{"type":"text/html","base64":false,"value":"On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network."}]}],"solutions":[{"lang":"en","value":"Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login."}]}],"credits":[{"lang":"en","value":"Discovered internally by the AxxonSoft QA team.","type":"finder"}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}}}}}