788
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Other
The main difference between the use of hard-coded passwords and the use of hard-coded
cryptographic keys is the false sense of security that the former conveys. Many people believe
that simply hashing a hard-coded password before storage will protect the information from
malicious users. However, many hashes are reversible (or at least vulnerable to brute force
attacks) -- and further, many authentication protocols simply request the hash itself, making it no
better than a password.
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
facilitate discussion and review by the broader ICS/OT community, and they are likely to change
in future CWE versions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Use of hard-coded cryptographic key
OWASP Top Ten 2007 A8 CWE More Specific Insecure Cryptographic Storage
OWASP Top Ten 2007 A9 CWE More Specific Insecure Communications
OWASP Top Ten 2004 A8 CWE More Specific Insecure Storage
Software Fault Patterns SFP33 Hardcoded sensitive data
ISA/IEC 62443 Part 2-4 Req SP.03.10 RE(1)
ISA/IEC 62443 Part 2-4 Req SP.03.10 RE(3)
ISA/IEC 62443 Part 3-3 Req SR 1.5
ISA/IEC 62443 Part 3-3 Req SR 4.3
ISA/IEC 62443 Part 4-1 Req SD-1
ISA/IEC 62443 Part 4-2 Req SR 4.3
ISA/IEC 62443 Part 4-2 Req CR 7.3
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-1283]Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its
implications for certifications and risk management". 2022 June 0. < https://www.forescout.com/
resources/ot-icefall-report/ >.
CWE-322: Key Exchange without Entity Authentication
Weakness ID : 322
Structure : Simple
Abstraction : Base
Description
The product performs a key exchange with an actor without verifying the identity of that actor.
Extended Description
Performing a key exchange will preserve the integrity of the information sent between two entities,
but this will not guarantee that the entities are who they claim they are. This may enable an
CWE Version 4.14
CWE-322: Key Exchange without Entity Authentication
CWE-322: Key Exchange without Entity Authentication