CVE-2026-121022 in Axxon One
Summary
by MITRE • 11/03/2026
Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified under CWE-1393 represents a critical failure in identity and authentication management within AxxonSoft Axxon One versions prior to 3.0.0, affecting both Windows and Linux deployments. This flaw specifically resides in the web client component of the software suite, which serves as the primary interface for system administration and monitoring. The core technical deficiency lies in the absence of a mandatory password change enforcement mechanism upon initial login using built-in administrative accounts with default credentials. When an administrator or user logs into a newly installed instance of Axxon One, the application accepts the pre-configured default username and password without prompting the user to establish a unique, secure credential set before granting full access privileges. This design oversight effectively leaves the system in a state where its highest-privilege account remains accessible via publicly known or easily guessable credentials, creating an immediate and severe security gap that persists until manual intervention occurs.
From an operational perspective, this vulnerability allows for remote unauthenticated attacks to achieve initial access with administrative rights without any prior authentication effort beyond knowing the default username, which is often static across installations. An attacker can exploit this by simply providing the known default password associated with the built-in administrator account. Once authenticated, the attacker gains complete control over the video management system, including the ability to view live and recorded footage from connected cameras, manipulate recording schedules, disable security alerts, and potentially modify user accounts or system configurations. In environments where Axxon One is deployed for physical security monitoring, such as corporate campuses, industrial facilities, or public infrastructure, this level of access can lead to significant privacy violations, operational disruption, and the potential use of the compromised system as a pivot point for further network intrusions. The impact is exacerbated by the fact that many organizations may not immediately verify default credentials after installation, leaving systems exposed during critical early deployment phases.
This vulnerability aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts: Default Accounts, which describes adversaries leveraging pre-configured accounts found in operating systems or applications to gain initial access. The failure to enforce credential rotation is a common anti-pattern in software development that violates fundamental principles of secure configuration and identity management. To mitigate this risk, organizations must ensure they upgrade to Axxon One version 3.0.0 or later, where the vendor has presumably implemented mandatory password change protocols upon first login for administrative accounts. For systems already deployed with vulnerable versions, immediate remediation involves manually changing the default administrator passwords to strong, unique credentials that comply with organizational complexity requirements. Additionally, network segmentation should be employed to restrict access to the web client interface only from trusted management networks, and regular security audits should include verification of default credential usage across all installed instances to prevent exploitation by automated scanning tools or malicious actors targeting known vulnerabilities in video management systems.