COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1392

Use of Default Credentials

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Extended description

It is common practice for products to be designed to use default keys, passwords, or other mechanisms for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Risk

What does successful exploitation lead to?

Gain Privileges or Assume Identity

Affected security scopes: Authentication

Defence

How is it prevented and fixed?

Requirements

Security requirement

Detail
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

Effectiveness: High

Architecture and Design

Architecture and design approach

Detail
Force the administrator to change the credential upon installation.

Effectiveness: High

Installation · Operation

Defence to apply across several lifecycle phases

Detail
The product administrator could change the defaults upon installation or during operation.

Effectiveness: Moderate