CWE-1392 covers a product that uses default credentials, such as passwords or cryptographic keys, for potentially critical functionality.
Vendors do it to make manufacturing or installation easier. The trouble is that if administrators never change the defaults, an attacker can get past authentication quickly across many organizations at once.
How it happens
A product ships with a built in password, key or secret. Someone deploys it and moves on. The value stays the same everywhere, and it is only a search away.
The observed examples in the record are a mix of devices and software:
- an RTU with default SSH accounts, CVE-2022-30270
- a data visualization package that uses default secret keys or cookie values when they are not set in environment variables, CVE-2021-41192
- a microcontroller board with a default password that allows admin access, CVE-2021-38759
- a cloud cluster management product with a default master encryption key, CVE-2018-3825
The software case is the sneakiest. A fallback such as "use this secret if none is configured" looks harmless in development and then ships.
import os
# Vulnerable pattern: a shared fallback secret.
SECRET_KEY = os.environ.get("APP_SECRET_KEY", "changeme")
# Fixed: no default. The app refuses to start without a real value.
SECRET_KEY = os.environ["APP_SECRET_KEY"]
What an attacker gains
MITRE lists authentication consequences: gaining privileges or assuming the identity of whoever the default belongs to.
How to find it
The record has no detection methods. Look for fallback values in config loading code, factory passwords in device documentation, and keys checked in beside the code. Our free dependency scan covers known vulnerable libraries, so pair it with a secrets search for the defaults in your own code.
How to fix it
MITRE's mitigations, with its effectiveness ratings:
- Requirements. Prohibit default, hard coded or other values that do not vary per installation, especially across separate organizations. Effectiveness: high.
- Architecture and design. Force the administrator to change the credential at installation. Effectiveness: high.
- Installation and operation. The administrator changes the defaults at install time or while running. Effectiveness: moderate.
Quick check
Why is a default credential worse than a weak one chosen by an admin?
It is the same across installations, so one discovery works against many organizations.
