CWE-258
AllowedEmpty Password in Configuration File
Abstraction: Variant · Status: Incomplete
Using an empty string as a password is insecure.
22 vulnerabilities reference this CWE, most recent first.
GHSA-RCCF-3GFP-FHPV
Vulnerability from github – Published: 2024-04-08 03:30 – Updated: 2024-08-01 15:31The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.
{
"affected": [],
"aliases": [
"CVE-2024-28744"
],
"database_specific": {
"cwe_ids": [
"CWE-258"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T01:15:56Z",
"severity": "HIGH"
},
"details": "The password is empty in the initial configuration of ACERA 9010-08 firmware v02.04 and earlier, and ACERA 9010-24 firmware v02.04 and earlier. An unauthenticated attacker may log in to the product with no password, and obtain and/or alter information such as network configuration and user information. The products are affected only when running in non MS mode with the initial configuration.",
"id": "GHSA-rccf-3gfp-fhpv",
"modified": "2024-08-01T15:31:37Z",
"published": "2024-04-08T03:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28744"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU99285099"
},
{
"type": "WEB",
"url": "https://www.furunosystems.co.jp/news/info/vulner20240401.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RXFJ-GVQJ-6MMM
Vulnerability from github – Published: 2025-07-25 15:30 – Updated: 2026-03-27 21:31Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality.
This issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025
{
"affected": [],
"aliases": [
"CVE-2025-4395"
],
"database_specific": {
"cwe_ids": [
"CWE-258"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-24T07:15:53Z",
"severity": "MODERATE"
},
"details": "Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system functionality. \n\nThis issue affects MyCareLink Patient Monitor models 24950 and 24952: before June 25, 2025",
"id": "GHSA-rxfj-gvqj-6mmm",
"modified": "2026-03-27T21:31:31Z",
"published": "2025-07-25T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4395"
},
{
"type": "WEB",
"url": "https://global.medtronic.com/xg-en/product-security/security-bulletins.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-205-01"
},
{
"type": "WEB",
"url": "https://www.medtronic.com/en-us/e/product-security/security-bulletins/mycarelink-patient-monitor-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Passwords should be at least eight characters long -- the longer the better. Avoid passwords that are in any way similar to other passwords you have. Avoid using words that may be found in a dictionary, names book, on a map, etc. Consider incorporating numbers and/or punctuation into your password. If you do use common words, consider replacing letters in that word with numbers and punctuation. However, do not use "similar-looking" punctuation. For example, it is not a good idea to change cat to c@t, ca+, (@+, or anything similar. Finally, it is never appropriate to use an empty string as a password.
No CAPEC attack patterns related to this CWE.