CWE-1392Use of Default Credentials

Description

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Common consequences

• Authentication→Gain Privileges or Assume Identity
  If admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.

Potential mitigations

• Requirements
  Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
• Architecture and Design
  Force the administrator to change the credential upon installation.
• Installation,Operation
  The product administrator could change the defaults upon installation or during operation.

Related CWEs

Recent CVEs classified under this CWE