CVE-2026-121022 PUBLISHED

Default Administrator Password Change Not Enforced in Axxon One Web Client

Assigner: AxxonSoft
Reserved: 03.11.2026 Published: 03.11.2026 Updated: 03.11.2026

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	AxxonSoft
Product	Axxon One
Versions	Default: unaffected affected from 0 to 3.0.0 (excl.)

Workarounds

On earlier versions, change the default administrator password in the desktop client immediately after installation, before the web server is reachable from the network.

Solutions

Upgrade Axxon One to version 3.0.0 or later, where the web client requires the default password to be changed on first login.

Credits

Discovered internally by the AxxonSoft QA team. finder

References

https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022

Problem Types

CWE-1393 Use of Default Password CWE

Impacts

CAPEC-70 Try Common or Default Usernames and Passwords