CWE-1394
Use of Default Cryptographic Key
AI Translation Available
The product uses a default cryptographic key for potentially critical functionality.
Status
incomplete
Abstraction
base
Affected Platforms
Extended Description
AI Translation
It is common practice for products to be designed to use
default keys. The rationale is to simplify the manufacturing
process or the system administrator's task of installation and
deployment into an enterprise. However, if admins do not
change the defaults, it is easier for attackers to bypass
authentication quickly across multiple organizations.
Technical Details
AI Translation
Common Consequences
authentication
Impacts
gain privileges or assume identity
Potential Mitigations
Phases:
requirements
architecture and design
installation
operation
Descriptions:
•
Force the administrator to change the credential upon installation.
•
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
•
The product administrator could change the defaults upon installation or during operation.