Use of Weak Credentials

Opis

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

By design, authentication protocols try to ensure that attackers must perform brute force attacks if they do not know the credentials such as a key or password. However, when these credentials are easily predictable or even fixed (as with default or hard-coded passwords and keys), then the attacker can defeat the mechanism without relying on brute force.

Credentials may be weak for different reasons, such as:

- Hard-coded (i.e., static and unchangeable by the administrator)

- Default (i.e., the same static value across different deployments/installations, but able to be changed by the administrator)

- Predictable (i.e., generated in a way that produces unique credentials across deployments/installations, but can still be guessed with reasonable efficiency)

- Previously Compromised (i.e., "leaked" credentials that were published as part of a data breach)

Even if a new, unique credential is intended to be generated for each product installation, if the generation is predictable, then that may also simplify guessing attacks.

Skutki

• Access Control

  Bypass Protection Mechanism

  An adversary could bypass intended authentication restrictions.

Zapobieganie

• Architecture and Design, Operation

  When the user changes or sets a password, check the password against a database of already compromised or breached passwords. These passwords are likely to be used in password guessing attacks.

  Skuteczność: Moderate

Przykłady podatności

• CVE-2022-30270 Remote Terminal Unit (RTU) uses default credentials for some SSH accounts
• CVE-2022-29965 Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords
• CVE-2022-30271 Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used in typical deployments
• CVE-2021-38759 microcontroller board has default password, allowing admin access
• CVE-2021-41192 data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables
• CVE-2020-8994 UART interface for AI speaker uses empty password for root shell
• CVE-2020-27020 password manager does not generate cryptographically strong passwords, allowing prediction of passwords using guessable details such as time of generation
• CVE-2020-8632 password generator for cloud application has small length value, making it easier for brute-force guessing
• CVE-2020-5365 network-attached storage (NAS) system has predictable default passwords for a diagnostics/support account
• CVE-2020-5248 IT asset management app has a default encryption key that is the same across installations
• CVE-2018-3825 cloud cluster management product has a default master encryption key
• CVE-2012-3503 Installation script has a hard-coded secret token value, allowing attackers to bypass authentication
• CVE-2010-2306 Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic
• CVE-2001-0618 Residential gateway uses the last 5 digits of the 'Network Name' or SSID as the default WEP key, which allows attackers to get the key by sniffing the SSID, which is sent in the clear

Słabość nadrzędna

• CWE-1390 Weak Authentication

Słabości podrzędne

• CWE-521 Weak Password Requirements
• CWE-798 Use of Hard-coded Credentials
• CWE-1392 Use of Default Credentials

Kiedy powstaje

• Requirements
• Architecture and Design
• Installation
• Operation

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, ICS/OT, Not Technology-Specific

Źródła

1. Researchers Out Default Passwords Packaged With ICS/SCADA Wares — Kelly Jackson Higgins, 2016
2. ICS Alert (ICS-ALERT-13-164-01): Medical Devices Hard-Coded Passwords — ICS-CERT, 2013
3. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022
4. Randstorm: You Can't Patch a House of Cards — Unciphered, 2023
5. Digital Identity Guidelines (SP 800-63B-4) — NIST, 5.1.1.2, 2025
6. Passwords, passwords everywhere — National Cyber Security Centre, 2022