Axxon One CVE-2026-121022

Exploitation requires a newly installed Axxon One system (before 3.0.0, Windows or Linux) on which the built-in administrator's default password has not yet been changed, because the web client failed to enforce the mandatory password change on first login. The attacker must have network reachability to the web client and must know or try the default credentials. The key limiting factor is that once an administrator changes the default password, the condition no longer holds and the attack fails - so exposure is confined to fresh installs and un-remediated deployments; this is the AT:P attack requirement in the vendor's CVSS 4.0 vector.

This is a genuine high-priority issue rather than an inflated CVSS number. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) describes a remote, network-reachable flaw requiring no legitimate credentials: an attacker simply logs in with the built-in administrator's default password. The vuln.today decision label is act_now, which signals urgency and aligns with the low-effort, high-impact nature of a default-credential flaw. The one mitigating signal is AT:P (an attack requirement): exploitation only works while the default password remains unchanged, i.e. on newly installed or un-remediated systems. No EPSS score, no CISA KEV listing, and no public PoC are present in the input, so there is no evidence of active or automated exploitation; the priority rests on ease of exploitation and impact, not on observed in-the-wild activity. Because default-credential issues are trivially exploitable by anyone who can reach the web client, the AC:L / PR:N combination makes the practical barrier very low wherever the precondition holds.

An attacker who can reach the Axxon One web client over the network targets a freshly installed server where the built-in administrator password was never changed, and simply logs in with the known default credentials. Because the web client did not force a password change on first login, the attacker obtains full administrator control of the video management system. No public exploit code is identified in the available data, but the technique requires no tooling beyond knowledge of the default credentials.