CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.
The device or software is delivered with default login credentials (username and password), which the user should change upon first startup. If this is not done, an attacker can use these known credentials to authenticate to the WebHMI interface over the network. Additionally, an error in displaying the default username in the WebHMI interface may cause the administrator to be unaware of the default account's existence, preventing remedial action.
An attacker gains full, unauthorized access to the system and can execute arbitrary commands, leading to violation of confidentiality, integrity, and availability of the resource (CVSS C:H/I:H/A:H).
Default authentication credentials (login and password) must be changed immediately upon first system startup. Subsequently, patches available from the manufacturer should be applied according to references (Schneider Electric document SEVD-2025-070-03). It is also recommended to restrict network access to the WebHMI interface through network segmentation and firewall implementation.
Schneider Electric products equipped with a WebHMI interface — specific versions indicated in manufacturer references (document SEVD-2025-070-03).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H