2271
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 2-4 Req SP.09.02 RE(1)
ISA/IEC 62443 Part 4-1 Req SR-3 b)
ISA/IEC 62443 Part 4-1 Req SI-2 b)
ISA/IEC 62443 Part 4-1 Req SI-2 d)
ISA/IEC 62443 Part 4-1 Req SG-3 d)
ISA/IEC 62443 Part 4-1 Req SG-6 b)
ISA/IEC 62443 Part 4-2 Req CR 1.1
ISA/IEC 62443 Part 4-2 Req CR 1.2
ISA/IEC 62443 Part 4-2 Req CR 1.5
ISA/IEC 62443 Part 4-2 Req CR 1.7
ISA/IEC 62443 Part 4-2 Req CR 1.8
ISA/IEC 62443 Part 4-2 Req CR 1.9
ISA/IEC 62443 Part 4-2 Req CR 1.14
ISA/IEC 62443 Part 4-2 Req CR 2.1
ISA/IEC 62443 Part 4-2 Req CR 4.3
ISA/IEC 62443 Part 4-2 Req CR 7.5
References
[REF-1303]Kelly Jackson Higgins. "Researchers Out Default Passwords Packaged With ICS/
SCADA Wares". 2016 January 4. < https://www.darkreading.com/endpoint/researchers-out-defaultpasswords-
packaged-with-ics-scada-wares >.2022-10-11.
[REF-1304]ICS-CERT. "ICS Alert (ICS-ALERT-13-164-01): Medical Devices Hard-Coded
Passwords". 2013 June 3. < https://www.cisa.gov/news-events/ics-alerts/ics-alert-13-164-01
>.2023-04-07.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
[REF-1374]Unciphered. "Randstorm: You Can't Patch a House of Cards". 2023 November 4. <
https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards >.2023-11-15.
CWE-1392: Use of Default Credentials
Weakness ID : 1392
Structure : Simple
Abstraction : Base
Description
The product uses default credentials (such as passwords or cryptographic keys) for potentially
critical functionality.
Extended Description
It is common practice for products to be designed to use default keys, passwords, or other
mechanisms for authentication. The rationale is to simplify the manufacturing process or the
system administrator's task of installation and deployment into an enterprise. However, if admins
CWE Version 4.14
CWE-1392: Use of Default Credentials
CWE-1392: Use of Default Credentials