CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client

CriticalCVSS 9.2 EPSS 0.38%

Published: 2026-11-03 10:46
Updated: 2026-11-03 23:17
Exploit status: No public exploit known

Description

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

Affected products

Product	Affected versions	Fixed in
AxxonSoft Axxon One	< 3.0.0	3.0.0

References

www.axxonsoft.com vendor-advisory

CVSS v4.0

9.2 Critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 9.2 · axxonsoft
v4.0 9.2 · 15ede60e-6fda-426e-be9c-e788f151a377
v3.1 8.1 · axxonsoft
v3.1 8.1 · 15ede60e-6fda-426e-be9c-e788f151a377

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.38% (percentile 32.3)
CWE: CWE-1393 Use of Default Password

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.