2272
do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple
organizations.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1391 Use of Weak Credentials 2269
ParentOf 1393 Use of Default Password 2273
ParentOf 1394 Use of Default Cryptographic Key 2275
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 255 Credentials Management Errors 2315
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Not OS-Specific (Prevalence = Undetermined)
Architecture : Not Architecture-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Authentication Gain Privileges or Assume Identity
Potential Mitigations
Phase: Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the
product - especially for separate organizations.
Effectiveness = High
Phase: Architecture and Design
Force the administrator to change the credential upon installation.
Effectiveness = High
Phase: Installation
Phase: Operation
The product administrator could change the defaults upon installation or during operation.
Effectiveness = Moderate
Demonstrative Examples
Example 1:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
CWE Version 4.14
CWE-1393: Use of Default Password
CWE-1393: Use of Default Password