COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1393

Use of Default Password

The product uses default passwords for potentially critical functionality.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product uses default passwords for potentially critical functionality.

Extended description

It is common practice for products to be designed to use default passwords for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, then it makes it easier for attackers to quickly bypass authentication across multiple organizations. There are many lists of default passwords and default-password scanning tools that are easily available from the World Wide Web.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

Risk

What does successful exploitation lead to?

Gain Privileges or Assume Identity

Affected security scopes: Authentication

Defence

How is it prevented and fixed?

Requirements

Security requirement

Detail
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

Effectiveness: High

Documentation

Documentation aşaması savunması

Detail
Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.

Effectiveness: Limited

Architecture and Design

Architecture and design approach

Detail
Force the administrator to change the credential upon installation.

Effectiveness: High

Installation · Operation

Defence to apply across several lifecycle phases

Detail
The product administrator could change the defaults upon installation or during operation.

Effectiveness: Moderate