2273
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
At least one OT product used default credentials.
Observed Examples
Reference Description
CVE-2022-30270 Remote Terminal Unit (RTU) uses default credentials for some SSH accounts
https://www.cve.org/CVERecord?id=CVE-2022-30270
CVE-2021-41192 data visualization/sharing package uses default secret keys or cookie values if
they are not specified in environment variables
https://www.cve.org/CVERecord?id=CVE-2021-41192
CVE-2021-38759 microcontroller board has default password
https://www.cve.org/CVERecord?id=CVE-2021-38759
CVE-2010-2306 Intrusion Detection System (IDS) uses the same static, private SSL keys for
multiple devices and installations, allowing decryption of SSL traffic
https://www.cve.org/CVERecord?id=CVE-2010-2306
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-1393: Use of Default Password
Weakness ID : 1393
Structure : Simple
Abstraction : Base
Description
The product uses default passwords for potentially critical functionality.
Extended Description
It is common practice for products to be designed to use default passwords for authentication. The
rationale is to simplify the manufacturing process or the system administrator's task of installation
and deployment into an enterprise. However, if admins do not change the defaults, then it makes it
easier for attackers to quickly bypass authentication across multiple organizations. There are many
lists of default passwords and default-password scanning tools that are easily available from the
World Wide Web.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-1393: Use of Default Password
CWE-1393: Use of Default Password