2268
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Access Control
Read Application Data
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
This weakness can lead to the exposure of resources
or functionality to unintended actors, possibly providing
attackers with sensitive information or even execute
arbitrary code.
Demonstrative Examples
Example 1:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple OT products used weak authentication.
Observed Examples
Reference Description
CVE-2022-30034 Chain: Web UI for a Python RPC framework does not use regex anchors to
validate user login emails (CWE-777), potentially allowing bypass of OAuth
(CWE-1390).
https://www.cve.org/CVERecord?id=CVE-2022-30034
CVE-2022-35248 Chat application skips validation when Central Authentication Service (CAS) is
enabled, effectively removing the second factor from two-factor authentication
https://www.cve.org/CVERecord?id=CVE-2022-35248
CVE-2021-3116 Chain: Python-based HTTP Proxy server uses the wrong boolean operators
(CWE-480) causing an incorrect comparison (CWE-697) that identifies an
authN failure if all three conditions are met instead of only one, allowing
bypass of the proxy authentication (CWE-1390)
https://www.cve.org/CVERecord?id=CVE-2021-3116
CVE-2022-29965 Distributed Control System (DCS) uses a deterministic algorithm to generate
utility passwords
https://www.cve.org/CVERecord?id=CVE-2022-29965
CVE-2022-29959 Initialization file contains credentials that can be decoded using a "simple
string transformation"
https://www.cve.org/CVERecord?id=CVE-2022-29959
CVE-2020-8994 UART interface for AI speaker uses empty password for root shell
https://www.cve.org/CVERecord?id=CVE-2020-8994
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
CWE Version 4.14
CWE-1391: Use of Weak Credentials
CWE-1391: Use of Weak Credentials