2270
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple OT products used weak credentials.
Observed Examples
Reference Description
[REF-1374] Chain: JavaScript-based cryptocurrency library can fall back to the insecure
Math.random() function instead of reporting a failure (CWE-392), thus reducing
the entropy (CWE-332) and leading to generation of non-unique cryptographic
keys for Bitcoin wallets (CWE-1391)
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards
CVE-2022-30270 Remote Terminal Unit (RTU) uses default credentials for some SSH accounts
https://www.cve.org/CVERecord?id=CVE-2022-30270
CVE-2022-29965 Distributed Control System (DCS) uses a deterministic algorithm to generate
utility passwords
https://www.cve.org/CVERecord?id=CVE-2022-29965
CVE-2022-30271 Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely
to be used in typical deployments
https://www.cve.org/CVERecord?id=CVE-2022-30271
CVE-2021-38759 microcontroller board has default password, allowing admin access
https://www.cve.org/CVERecord?id=CVE-2021-38759
CVE-2021-41192 data visualization/sharing package uses default secret keys or cookie values if
they are not specified in environment variables
https://www.cve.org/CVERecord?id=CVE-2021-41192
CVE-2020-8994 UART interface for AI speaker uses empty password for root shell
https://www.cve.org/CVERecord?id=CVE-2020-8994
CVE-2020-27020 password manager does not generate cryptographically strong passwords,
allowing prediction of passwords using guessable details such as time of
generation
https://www.cve.org/CVERecord?id=CVE-2020-27020
CVE-2020-8632 password generator for cloud application has small length value, making it
easier for brute-force guessing
https://www.cve.org/CVERecord?id=CVE-2020-8632
CVE-2020-5365 network-attached storage (NAS) system has predictable default passwords for
a diagnostics/support account
https://www.cve.org/CVERecord?id=CVE-2020-5365
CVE-2020-5248 IT asset management app has a default encryption key that is the same across
installations
https://www.cve.org/CVERecord?id=CVE-2020-5248
CVE-2012-3503 Installation script has a hard-coded secret token value, allowing attackers to
bypass authentication
https://www.cve.org/CVERecord?id=CVE-2012-3503
CVE-2010-2306 Intrusion Detection System (IDS) uses the same static, private SSL keys for
multiple devices and installations, allowing decryption of SSL traffic
https://www.cve.org/CVERecord?id=CVE-2010-2306
CVE-2001-0618 Residential gateway uses the last 5 digits of the 'Network Name' or SSID as
the default WEP key, which allows attackers to get the key by sniffing the
SSID, which is sent in the clear
https://www.cve.org/CVERecord?id=CVE-2001-0618
MemberOf Relationships
CWE Version 4.14
CWE-1392: Use of Default Credentials
CWE-1392: Use of Default Credentials