2275
Reference Description
CVE-2021-38759 microcontroller board has default password
https://www.cve.org/CVERecord?id=CVE-2021-38759
CVE-2021-44480 children's smart watch has default passwords allowing attackers to send SMS
commands and listen to the device's surroundings
https://www.cve.org/CVERecord?id=CVE-2021-44480
CVE-2020-11624 surveillance camera has default password for the admin account
https://www.cve.org/CVERecord?id=CVE-2020-11624
CVE-2018-15719 medical dental records product installs a MySQL database with a blank default
password
https://www.cve.org/CVERecord?id=CVE-2018-15719
CVE-2014-9736 healthcare system for archiving patient images has default passwords for key
management and storage databases
https://www.cve.org/CVERecord?id=CVE-2014-9736
CVE-2000-1209 database product installs admin account with default null password, allowing
privileges, as exploited by various worms
https://www.cve.org/CVERecord?id=CVE-2000-1209
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1368 ICS Dependencies (& Architecture): External Digital
Systems
1358 2505
MemberOf 1376 ICS Engineering (Construction/Deployment): Security
Gaps in Commissioning
1358 2512
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1303]Kelly Jackson Higgins. "Researchers Out Default Passwords Packaged With ICS/
SCADA Wares". 2016 January 4. < https://www.darkreading.com/endpoint/researchers-out-defaultpasswords-
packaged-with-ics-scada-wares >.2022-10-11.
CWE-1394: Use of Default Cryptographic Key
Weakness ID : 1394
Structure : Simple
Abstraction : Base
Description
The product uses a default cryptographic key for potentially critical functionality.
Extended Description
It is common practice for products to be designed to use default keys. The rationale is to simplify
the manufacturing process or the system administrator's task of installation and deployment into
an enterprise. However, if admins do not change the defaults, it is easier for attackers to bypass
authentication quickly across multiple organizations.
CWE Version 4.14
CWE-1394: Use of Default Cryptographic Key
CWE-1394: Use of Default Cryptographic Key