Default Administrator Password Change Not Enforced in Axxon One Web Client

Summary

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

Remediation

1. Inventory every AxxonSoft Axxon One deployment, including staging.
2. Upgrade AxxonSoft Axxon One to 3.0.0.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121022