Use of Default Credentials

Opis

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

It is common practice for products to be designed to use default keys, passwords, or other mechanisms for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.

Skutki

• Authentication

  Gain Privileges or Assume Identity

Zapobieganie

• Requirements

  Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

  Skuteczność: High

• Architecture and Design

  Force the administrator to change the credential upon installation.

  Skuteczność: High

• Installation, Operation

  The product administrator could change the defaults upon installation or during operation.

  Skuteczność: Moderate

Przykłady podatności

• CVE-2022-30270 Remote Terminal Unit (RTU) uses default credentials for some SSH accounts
• CVE-2021-41192 data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables
• CVE-2021-38759 microcontroller board has default password, allowing admin access
• CVE-2018-3825 cloud cluster management product has a default master encryption key
• CVE-2010-2306 Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic

Słabość nadrzędna

• CWE-1391 Use of Weak Credentials

Słabości podrzędne

• CWE-1393 Use of Default Password
• CWE-1394 Use of Default Cryptographic Key

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific, Not OS-Specific, Not Architecture-Specific, ICS/OT, Not Technology-Specific

Źródła

1. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022