{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-121022","assignerOrgId":"15ede60e-6fda-426e-be9c-e788f151a377","state":"PUBLISHED","assignerShortName":"AxxonSoft","dateReserved":"2026-11-03T08:40:19.154Z","datePublished":"2026-11-03T08:46:13.492Z","dateUpdated":"2026-11-03T08:46:13.492Z"},"containers":{"cna":{"providerMetadata":{"orgId":"15ede60e-6fda-426e-be9c-e788f151a377","shortName":"AxxonSoft","dateUpdated":"2026-11-03T08:46:13.492Z"},"title":"Default Administrator Password Change Not Enforced in Axxon One Web Client","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-1393","description":"CWE-1393 Use of Default Password","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-70","descriptions":[{"lang":"en","value":"CAPEC-70 Try Common or Default Usernames and Passwords"}]}],"affected":[{"vendor":"AxxonSoft","product":"Axxon One","platforms":["Windows","Linux"],"versions":[{"status":"affected","version":"0","lessThan":"3.0.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.","supportingMedia":[{"type":"text/html","base64":false,"value":"Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login."}]}],"references":[{"url":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.1,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"workarounds":[{"lang":"en","value":"On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.","supportingMedia":[{"type":"text/html","base64":false,"value":"On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network."}]}],"solutions":[{"lang":"en","value":"Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login."}]}],"credits":[{"lang":"en","value":"Discovered internally by the AxxonSoft QA team.","type":"finder"}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}}}}