CWE-1393 is the use of default passwords for potentially critical functionality. It sits under the broader default credentials entry and is specific to passwords.
It affects anyone who makes or deploys products with a built in login, and the record flags ICS and OT systems in particular.
How it happens
Products often ship with a default password to ease manufacturing or help an administrator get an install running. If the administrator never changes it, attackers can bypass authentication across many organizations quickly. MITRE notes that lists of default passwords and scanning tools for them are easy to find on the web.
Observed examples from the record:
- CVE-2022-30270: an RTU with default credentials for some SSH accounts.
- CVE-2022-2336: an OPC UA industrial automation product with a default password.
- CVE-2021-38759: a microcontroller board with a default admin password.
- CVE-2021-44480: a children's smart watch with default passwords that allowed attackers to send SMS commands and listen to the device's surroundings.
What an attacker gains
Authentication bypass, then whatever the account allows. The record lists gaining privileges or assuming identity.
How to find it
The record lists no detection methods. Check device and product setup flows: is a password present before the admin sets one? Do two units out of the box share it? Search code for password strings in config and firmware images.
How to fix it
MITRE's mitigations:
- Requirements. Prohibit default or hard coded values that do not vary per installation. Effectiveness: high.
- Architecture and design. Force the administrator to change the credential on installation. Effectiveness: high.
- Documentation. Make documentation emphasize the default passwords and the steps to change them. Effectiveness: limited.
- Installation and operation. The administrator changes the defaults. Effectiveness: moderate.
Note the ranking. Documentation alone is the weakest option, because many installers never read it.
Quick check
Which mitigation does MITRE rate as limited?
Documenting the default password and how to change it. Prohibiting defaults and forcing a change at install are rated high.
