Détail du CWE-1394

CWE-1394

Use of Default Cryptographic Key
2022-10-13
00h00 +00:00
Incomplete
2026-10-28
00h00 +00:00
CWE Mitre.org
Notifications pour un CWE
Restez informé de toutes modifications pour un CWE spécifique.
Gestion des notifications

Nom: Use of Default Cryptographic Key

The product uses a default cryptographic key for potentially critical functionality.

Informations générales

Modes d'introduction

Architecture and Design : It is common practice for products to be designed to use default keys. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, there is a risk that admins might not change the defaults.

Plateformes applicables

Langue

Classe : Not Language-Specific (Undetermined)

Systèmes d’exploitation

Classe : Not OS-Specific (Undetermined)

Architectures

Classe : Not Architecture-Specific (Undetermined)

Technologies

Classe : Not Technology-Specific (Undetermined)

Conséquences courantes

Portée Impact Probabilité
AuthenticationGain Privileges or Assume Identity

Note : It is easier for attackers to bypass authentication quickly across multiple organizations.

Exemples observés

Références Description

CVE-2018-3825

cloud cluster management product has a default master encryption key

CVE-2016-1561

backup storage product has a default SSH public key in the authorized_keys file, allowing root access

CVE-2010-2306

Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic

Mesures d’atténuation potentielles

Phases : Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Phases : Architecture and Design
Force the administrator to change the credential upon installation.
Phases : Installation // Operation
The product administrator could change the defaults upon installation or during operation.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Soumission

Nom Organisation Date Date de publication Version
CWE Content Team MITRE 2022-10-07 +00:00 2022-10-13 +00:00 4.9

Modifications

Nom Organisation Date Commentaire
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Common_Consequences, Description, Modes_of_Introduction
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.