Default Administrator Credentials Bypass in AxxonSoft Axxon One

CVE-2026-121022 exposes a critical authentication flaw in AxxonSoft Axxon One's web client where newly installed systems retain default administrator credentials without enforcing a mandatory password change on first login. This vulnerability affects both Windows and Linux deployments and allows unauthenticated remote attackers to gain immediate administrative access using publicly known default credentials. With a CVSS score of 8.1, this represents a severe risk to organizations deploying Axxon One, particularly in physically security, surveillance, and access control environments where the platform is commonly used. The vulnerability is especially dangerous because it requires no exploitation technique—attackers need only standard network access to the web interface and common default credentials.

While CVE-2026-121022 does not map to specific MITRE ATT&CK techniques (reflecting its nature as an authentication bypass rather than a post-exploitation behavior), Casky's platform would help practitioners detect related attack patterns through skills focused on initial access and credential-based compromise. Security teams should monitor for: (1) successful web client authentication attempts from unexpected sources using default usernames, (2) administrative account activity immediately following system deployment without prior credential rotation evidence, and (3) unusual access patterns to security configuration interfaces that typically follow initial compromise of administrative accounts. While Casky's current 754 mapped skills don't include specific detections for this CVE, practitioners using Claude AI with extended reasoning can develop custom detection logic by analyzing authentication logs for default credential usage patterns and correlating them with system deployment timelines—a capability that Casky's framework supports through flexible skill creation and threat intelligence correlation.