Weakness (CWE)
CWE-1394: Use of Default Cryptographic Key
The product uses a default cryptographic key for potentially critical functionality.
How to prevent it (3 mitigations)
-
Requirements
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
-
Architecture and Design
Force the administrator to change the credential upon installation.
-
Installation, Operation
The product administrator could change the defaults upon installation or during operation.
Source: MITRE CWE-1394
4 results · Clear filters · Feed
-
High 7.8
About Time Technologies｜Herowatch Go - Security Misconfiguration
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
-
High 8.1
Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can …
-
High 7.7
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions…
-
High 8.6
Publicly Known Cryptographic Machine Key In Procura Portal Application
Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.