Live › vulnerability › CVE-2026-121022
The web client of AxxonSoft Axxon One before 3.0.0 did not force a change of the built-in administrator's default password on first login. A remote unauthenticated attacker can log in as administrator on a newly installed system using the default credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Axxon One installations on Windows or Linux running a version before 3.0.0, especially newly installed systems where the built-in administrator still has its default password. The sources do not say whether the flaw is reachable outside a local network or behind a firewall.
No product ranges from the sources yet.
3.0.0.3.0.0 or later, per the NVD entry.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
This page as .md · .json · in your agent: get_signal("CVE-2026-121022")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.