CVE-2026-121022
HighCVSS 8.1Summary
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 allows a remote unauthenticated attacker to log in as the built-in administrator with default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
Risk Assessment
An attacker can gain full administrative access to the surveillance system without any credentials, risking takeover of cameras and data. The risk is especially high for freshly deployed systems exposed to the network.
Recommendation
Update Axxon One to version 3.0.0 or later and immediately change the default administrator password on all existing installations. Restrict access to the web client from external networks.
Other vulnerabilities in Axxon One
See all- CVE-2026-121021Medium
Plaintext storage of a password (CWE-256) in the SecurityManager shared configuration of AxxonSoft Axxon One before 3.1.0 allows a local attacker with read access to the configuration directory or backups to obtain the LDAP service account password from the main.conf file.
- CVE-2026-121020Medium
Exposure of sensitive information to an unauthorized actor (CWE-200) in the security configuration API of AxxonSoft Axxon One before 3.2.0 allows a remote authenticated low-privileged user to enumerate all configured users and roles, because the user configuration request returned complete lists regardless of the caller's permissions.
- CVE-2025-10223Medium
Insufficient Session Expiration in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows an authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.
Original NVD description (English source)
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS