CWEweakness

CWE-1392 Use of Default Credentials

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

Common consequences

• Authentication: Gain Privileges or Assume Identity — If admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.

Potential mitigations

• [Requirements] Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations. • [Architecture and Design] Force the administrator to change the credential upon installation. • [Installation, Operation] The product administrator could change the defaults upon installation or during operation.

Observed examples

• CVE-2022-30270: Remote Terminal Unit (RTU) uses default credentials for some SSH accounts • CVE-2021-41192: data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables • CVE-2021-38759: microcontroller board has default password, allowing admin access • CVE-2018-3825: cloud cluster management product has a default master encryption key • CVE-2010-2306: Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic

Related

Observed example · CVE (5)

  • CVE-2022-30270 The Motorola ACE1000 RTU through 2022-05-02 has default credentials. vulnerability
  • CVE-2021-38759 Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. vulnerability
  • CVE-2021-41192 Redash is a package for data visualization and sharing. vulnerability
  • CVE-2018-3825 In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper… vulnerability
  • CVE-2010-2306 The default installation of Sourcefire 3D Sensor 1000, 2000, and 9900; and Defense Center 1000; uses the same static, private SSL keys for… vulnerability

Child of · CWE (1)

  • CWE-1391 Use of Weak Credentials weakness

Referenced by CVE · weakness (130)

  • CVE-2026-77056 boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. vulnerability
  • CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread… vulnerability
  • CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. vulnerability
  • CVE-2026-77933 DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static… vulnerability
  • CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super… vulnerability
  • CVE-2026-111998 Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin… vulnerability
  • CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain… vulnerability
  • CVE-2026-111329 JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to… vulnerability
  • CVE-2026-108783 A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. vulnerability
  • CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. vulnerability
  • CVE-2026-100103 Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. vulnerability
  • CVE-2026-90924 Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. vulnerability
  • CVE-2026-97064 X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. vulnerability
  • CVE-2026-97649 A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. vulnerability
  • CVE-2026-90940 novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows… vulnerability
  • CVE-2026-90498 A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. vulnerability
  • CVE-2026-90451 An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled… vulnerability
  • CVE-2026-90456 An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative… vulnerability
  • CVE-2026-78573 IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default… vulnerability
  • CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager (IdM)… vulnerability
  • CVE-2026-76155 Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative… vulnerability
  • CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc… vulnerability
  • CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. vulnerability
  • CVE-2026-41939 Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface… vulnerability
  • CVE-2026-44761 SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration… vulnerability
  • CVE-2026-3144 IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the… vulnerability
  • CVE-2026-58466 AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as… vulnerability
  • CVE-2026-58453 JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows… vulnerability
  • CVE-2026-46386 OpenProject is open-source, web-based project management software. vulnerability
  • CVE-2026-44273 Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. vulnerability
Show all 130 ›

Referenced by CWE · child of (2)

  • CWE-1393 Use of Default Password weakness
  • CWE-1394 Use of Default Cryptographic Key weakness

Referenced by OWASP · mapped cwe (1)

  • A07:2025 Authentication Failures Top 10 2025