624
In the Inbound variant, a default administration account is created, and a simple password is
hard-coded into the product and associated with that account. This hard-coded password is the
same for each installation of the product, and it usually cannot be changed or disabled by system
administrators without manually modifying the program, or otherwise patching the product. If the
password is ever discovered or published (a common occurrence on the Internet), then anybody
with knowledge of this password can access the product. Finally, since all installations of the
product will have the same password, even across different organizations, this enables massive
attacks such as worms to take place.
The Outbound variant applies to front-end systems that authenticate with a back-end service. The
back-end service may require a fixed password which can be easily discovered. The programmer
may simply hard-code those back-end credentials into the front-end product. Any user of that
program may be able to extract the password. Client-side systems with hard-coded passwords
pose even more of a threat, since the extraction of a password from a binary is usually very simple.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 798 Use of Hard-coded Credentials 1690
PeerOf 257 Storing Passwords in a Recoverable Format 618
PeerOf 321 Use of Hard-coded Cryptographic Key 785
PeerOf 257 Storing Passwords in a Recoverable Format 618
CanFollow 656 Reliance on Security Through Obscurity 1444
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 798 Use of Hard-coded Credentials 1690
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 798 Use of Hard-coded Credentials 1690
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
CWE Version 4.14
CWE-259: Use of Hard-coded Password
CWE-259: Use of Hard-coded Password