CVE-2026-22109
NoneCVSS
—
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-22105 Delta UFC500 charging stations derive the default credentials of the Service account from… CWE-1392
- CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default… CWE-1392
- CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1392
- CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that allows… CWE-1392
- CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials… CWE-1392
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
- CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
- CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392