Overview
CVE-2026-121022 is a use of default password (CWE-1393) flaw in the web client of AxxonSoft Axxon One, a video management and surveillance platform. In versions before 3.0.0 on both Windows and Linux, a remote unauthenticated attacker can sign in as the built-in administrator using the default credentials on a newly installed system. The web client did not enforce the mandatory password change on first login.
The CVE was published on 2026-11-03. The CNA vector gives a CVSS 3.1 score of 8.1 (High). Other sources score it differently (VulDB lists 7.3), and NVD analysis was still pending when this was written.
Technical Details
| Item | Detail |
|---|---|
| Weakness | CWE-1393: Use of Default Password |
| Component | Axxon One web client |
| Attack vector | Network, no authentication |
| Condition | Newly installed system where the default password has not been changed |
| Impact | Full administrator access to the web client |
AxxonSoft documentation lists the default administrator login as root / root. The product is supposed to force a password change at first sign-in, but the web client did not enforce it, so a fresh or never-hardened deployment stayed reachable with publicly documented credentials.
Exposure and Status
- AxxonSoft's QA team found the issue internally.
- VulDB reports no public exploit and no technical write-up beyond the default-credential behavior.
- It is not listed in CISA KEV at the time of writing.
- Exploitation needs no skill: anyone who can reach the web client on an unchanged install can try the documented login.
Remediation
- Upgrade Axxon One to 3.0.0 or later.
- On any existing install, confirm the built-in administrator password was changed from the default. Rotate it now if unsure.
- Do not expose the Axxon One web client directly to the internet. Restrict it to a management VLAN or VPN.
- Review administrator logins and recent configuration changes on any instance that was reachable before patching.
- Note that two other Axxon One CVEs published in the same batch (CVE-2026-121021 and CVE-2026-121020) are fixed in later releases (3.1.0 and 3.2.0), so plan to go beyond 3.0.0 where possible.