The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
View on MITREThe impact of insecure defaults varies widely depending on the functionality that the product controls.
No mitigation information available for this CWE.
No detection method information available for this CWE.
This code attempts to login a user using credentials from a POST request:
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any value included in the POST request if register_globals is enabled. An attacker can send a POST request with an unexpected third value 'authorized' set to 'true' and gain authorized status without supplying valid credentials.
// $user and $pass automatically set from POST request if (login_user($user,$pass)) {$authorized = true;} ... if ($authorized) {generatePage();}This code attempts to login a user using credentials from a POST request:
Because the $authorized variable is never initialized, PHP will automatically set $authorized to any value included in the POST request if register_globals is enabled. An attacker can send a POST request with an unexpected third value 'authorized' set to 'true' and gain authorized status without supplying valid credentials.
$user = $_POST['user'];$pass = $_POST['pass'];$authorized = false;if (login_user($user,$pass)) {$authorized = true;} ...insecure default variable initialization in BIOS firmware for a hardware board allows DoS
View DetailsA generic database browser interface has a default mode that exposes a web server to the network, allowing queries to the database.
View DetailsAdditional facts reviewed against primary or authoritative security sources.
Documented detection approaches include Automated Static Analysis; recorded impacts include Varies by Context; the entry maps to CAPEC-665. Use these source-defined anchors to turn CWE-1188 into implementation, review, and verification checks for the affected component.
CWE-1188: Initialization of a Resource with an Insecure Default — MITRE CWEUse NIST SSDF practices to make prevention of CWE-1188, Initialization of a Resource with an Insecure Default, an explicit development outcome. Translate the CWE definition into security requirements and design constraints, choose safer implementation patterns and toolchain checks, and define acceptance evidence before release. Feed every confirmed occurrence back into the requirements, design review, and coding rules so the same root cause is removed across the product rather than patched in one location.
NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and TechnologyUse CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-1188, Initialization of a Resource with an Insecure Default, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.
Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security AgencyApply MITRE's full root-cause mapping guidance when using CWE-1188, Initialization of a Resource with an Insecure Default. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.
CVE to CWE Root Cause Mapping Guidance — MITRE CWEApply MITRE's root-cause mapping quick tips to CWE-1188, Initialization of a Resource with an Insecure Default. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.
CVE to CWE Root Cause Mapping Quick Tips — MITRE CWECWE-1188: Initialization of a Resource with an Insecure Default is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
If exploited, CWE-1188 (Initialization of a Resource with an Insecure Default) it can compromise Other, leading to outcomes such as Varies by Context.
CWE-1188 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-1188, including CVE-2022-36349 and CVE-2022-42467. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-1188 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.