Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1392: Use of Default Credentials

Base Incomplete

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

How to prevent it (3 mitigations)

  1. Requirements

    Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

  2. Architecture and Design

    Force the administrator to change the credential upon installation.

  3. Installation, Operation

    The product administrator could change the defaults upon installation or during operation.

Source: MITRE CWE-1392

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    CVE-2024-12856 Public exploit EPSS 84%

    Four-Faith Industrial Router adjust_sys_time OS Command Injection

    The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. At least firmware version 2.0 allows authenticated and remote attackers to execute arbitrary OS commands over HTTP when modifying the system…

    Four-Faith F3x36 F3x24
  • High 8.8
    CVE-2024-4007 Public exploit

    Hard coded default credential contained in install package

    Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.

    ABB MATRIX Series(MAT-x) NEXUS Series (NEX-2x, NEXUS-3-x) ASPECT Enterprise (ASP-ENT-x) ICS / OT