{"@ID": "1391", "@Name": "Use of Weak Credentials", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.", "Extended_Description": {"xhtml:p": ["By design, authentication protocols try to ensure that attackers must perform brute force attacks if they do not know the credentials such as a key or password. However, when these credentials are easily predictable or even fixed (as with default or hard-coded passwords and keys), then the attacker can defeat the mechanism without relying on brute force.", "Credentials may be weak for different reasons, such as:", "Even if a new, unique credential is intended to be generated for each product installation, if the generation is predictable, then that may also simplify guessing attacks."], "xhtml:ul": {"xhtml:li": ["Hard-coded (i.e., static and unchangeable by the administrator)", "Default (i.e., the same static value across different deployments/installations, but able to be changed by the administrator)", "Predictable (i.e., generated in a way that produces unique credentials across deployments/installations, but can still be guessed with reasonable efficiency)", "Previously Compromised (i.e., \"leaked\" credentials that were published as part of a data breach)"]}}, "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "1390", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": [{"Ordinality": "Primary"}, {"Ordinality": "Resultant"}]}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Operating_System": {"@Class": "Not OS-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": [{"@Class": "ICS/OT", "@Prevalence": "Undetermined"}, {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}]}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Requirements"}, {"Phase": "Architecture and Design"}, {"Phase": "Installation"}, {"Phase": "Operation"}]}, "Common_Consequences": {"Consequence": {"Scope": "Access Control", "Impact": "Bypass Protection Mechanism", "Note": "An adversary could bypass intended authentication restrictions."}}, "Potential_Mitigations": {"Mitigation": {"Phase": ["Architecture and Design", "Operation"], "Description": "When the user changes or sets a password, check\n\t  the password against a database of already compromised or\n\t  breached passwords. These passwords are likely to be used in\n\t  password guessing attacks.", "Effectiveness": "Moderate"}}, "Demonstrative_Examples": {"Demonstrative_Example": {"@Demonstrative_Example_ID": "DX-153", "Intro_Text": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.", "Body_Text": "Multiple OT products used weak credentials."}}, "Observed_Examples": {"Observed_Example": [{"Reference": "[REF-1374]", "Description": "Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)", "Link": "https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards"}, {"Reference": "CVE-2022-30270", "Description": "Remote Terminal Unit (RTU) uses default credentials for some SSH accounts", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-30270"}, {"Reference": "CVE-2022-29965", "Description": "Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-29965"}, {"Reference": "CVE-2022-30271", "Description": "Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used in typical deployments", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-30271"}, {"Reference": "CVE-2021-38759", "Description": "microcontroller board has default password, allowing admin access", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-38759"}, {"Reference": "CVE-2021-41192", "Description": "data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-41192"}, {"Reference": "CVE-2020-8994", "Description": "UART interface for AI speaker uses empty password for root shell", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-8994"}, {"Reference": "CVE-2020-27020", "Description": "password manager does not generate cryptographically strong passwords, allowing prediction of passwords using guessable details such as time of generation", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-27020"}, {"Reference": "CVE-2020-8632", "Description": "password generator for cloud application has small length value, making it easier for brute-force guessing", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-8632"}, {"Reference": "CVE-2020-5365", "Description": "network-attached storage (NAS) system has predictable default passwords for a diagnostics/support account", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-5365"}, {"Reference": "CVE-2020-5248", "Description": "IT asset management app has a default encryption key that is the same across installations", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-5248"}, {"Reference": "CVE-2018-3825", "Description": "cloud cluster management product has a default master encryption key", "Link": "https://www.cve.org/CVERecord?id=CVE-2018-3825"}, {"Reference": "CVE-2012-3503", "Description": "Installation script has a hard-coded secret token value, allowing attackers to bypass authentication", "Link": "https://www.cve.org/CVERecord?id=CVE-2012-3503"}, {"Reference": "CVE-2010-2306", "Description": "Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-2306"}, {"Reference": "CVE-2001-0618", "Description": "Residential gateway uses the last 5 digits of the 'Network Name' or SSID as the default WEP key, which allows attackers to get the key by sniffing the SSID, which is sent in the clear", "Link": "https://www.cve.org/CVERecord?id=CVE-2001-0618"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 2-4", "Entry_Name": "Req SP.09.02 RE(1)"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SR-3 b)"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SI-2 b)"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SI-2 d)"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SG-3 d)"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-1", "Entry_Name": "Req SG-6 b)"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.1"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.2"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.5"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.7"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.8"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.9"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 1.14"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 2.1"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 4.3"}, {"@Taxonomy_Name": "ISA/IEC 62443", "Entry_ID": "Part 4-2", "Entry_Name": "Req CR 7.5"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-1303"}, {"@External_Reference_ID": "REF-1304"}, {"@External_Reference_ID": "REF-1283"}, {"@External_Reference_ID": "REF-1374"}, {"@External_Reference_ID": "REF-1488", "@Section": "5.1.1.2"}, {"@External_Reference_ID": "REF-1514"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is a Class and might have Base-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2022-10-06", "Submission_Version": "4.9", "Submission_ReleaseDate": "2022-10-13"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-02-29", "Modification_Version": "4.14", "Modification_ReleaseDate": "2024-02-29", "Modification_Comment": "updated Observed_Examples, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-11-19", "Modification_Version": "4.16", "Modification_ReleaseDate": "2024-11-19", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-09-09", "Modification_Version": "4.18", "Modification_ReleaseDate": "2025-09-09", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Common_Consequences, Description, Potential_Mitigations, References, Relationships, Weakness_Ordinalities"}], "Contribution": [{"@Type": "Content", "Contribution_Name": "\"Mapping CWE to 62443\" Sub-Working Group", "Contribution_Organization": "CWE-CAPEC ICS/OT SIG", "Contribution_Date": "2023-06-29", "Contribution_Version": "4.12", "Contribution_ReleaseDate": "2023-06-29", "Contribution_Comment": "Suggested mappings to ISA/IEC 62443."}, {"@Type": "Content", "Contribution_Name": "Michal Biesiada", "Contribution_Date": "2023-07-07", "Contribution_Version": "4.19", "Contribution_ReleaseDate": "2025-12-11", "Contribution_Comment": "Proposed inclusion of already-compromised passwords, leading to modifications of extended description, mitigations, and references"}]}}