CWEweakness

CWE-1394 Use of Default Cryptographic Key

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product uses a default cryptographic key for potentially critical functionality.

Common consequences

• Authentication: Gain Privileges or Assume Identity — It is easier for attackers to bypass authentication quickly across multiple organizations.

Potential mitigations

• [Requirements] Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations. • [Architecture and Design] Force the administrator to change the credential upon installation. • [Installation, Operation] The product administrator could change the defaults upon installation or during operation.

Observed examples

• CVE-2018-3825: cloud cluster management product has a default master encryption key • CVE-2016-1561: backup storage product has a default SSH public key in the authorized_keys file, allowing root access • CVE-2010-2306: Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic

Related

Observed example · CVE (3)

  • CVE-2018-3825 In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper… vulnerability
  • CVE-2016-1561 ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote… vulnerability
  • CVE-2010-2306 The default installation of Sourcefire 3D Sensor 1000, 2000, and 9900; and Defense Center 1000; uses the same static, private SSL keys for… vulnerability

Child of · CWE (1)

  • CWE-1392 Use of Default Credentials weakness

Referenced by CVE · weakness (23)

  • CVE-2026-92777 A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass… vulnerability
  • CVE-2026-111367 BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe… vulnerability
  • CVE-2020-37281 Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to… vulnerability
  • CVE-2026-72895 A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC… vulnerability
  • CVE-2026-107177 Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt… vulnerability
  • CVE-2026-75870 Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. vulnerability
  • CVE-2026-54887 Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the… vulnerability
  • CVE-2026-5039 TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management… vulnerability
  • CVE-2026-20709 Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J… vulnerability
  • CVE-2026-2215 A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. vulnerability
  • CVE-2026-25815 Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild… vulnerability
  • CVE-2025-41742 Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default… vulnerability
  • CVE-2025-41744 Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted… vulnerability
  • CVE-2025-55049 Use of Default Cryptographic Key (CWE-1394) vulnerability
  • CVE-2025-44954 RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. vulnerability
  • CVE-2025-1688 Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after… vulnerability
  • CVE-2025-26849 There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. vulnerability
  • CVE-2024-48956 Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to… vulnerability
  • CVE-2024-11619 A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. vulnerability
  • CVE-2024-10748 A vulnerability, which was classified as problematic, has been found in Cosmote Greece What's Up App 4.47.3 on Android. vulnerability
  • CVE-2024-1275 Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment… vulnerability
  • CVE-2024-29037 datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. vulnerability
  • CVE-2023-6451 Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication… vulnerability