Incomplete in the CWE catalog · 11 CVEs mapped
Using an empty string as a password is insecure.
CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
🚨 A blank root password! That’s the shocking vulnerability behind CVE-2025-9276, letting remote attackers waltz into systems running the Cockroach Labs cockroach-k8s-request-cert container image. 🔥 Think of it like a hotel that forgot to change the master key after check-in — anyone can walk right in without a reservation. This oversight leaves your system exposed to anyone who knows where to look! An attacker can bypass all authentication measures and gain full access to the system, potentially compromising sensitive data or disrupting services. This could lead to absolute chaos, as unauthorized users would have the keys to the kingdom!