CWE-1393: Use of Default Password
The product uses default passwords for potentially critical functionality.
View on MITREExtended Description
It is common practice for products to be designed to use default passwords for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, then it makes it easier for attackers to quickly bypass authentication across multiple organizations. There are many lists of default passwords and default-password scanning tools that are easily available from the World Wide Web.
Technical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Mitigation Strategies
Phase
Description
Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Effectiveness
HighPhase
Description
Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
Effectiveness
LimitedPhase
Description
Force the administrator to change the credential upon installation.
Effectiveness
HighPhase
Description
The product administrator could change the defaults upon installation or during operation.
Effectiveness
ModerateDetection Methods
No detection method information available for this CWE.
Code Examples & CVEs
Observed CVE Examples (8)
OPC Unified Architecture (OPC UA) industrial automation product has a default password
View Detailschildren's smart watch has default passwords allowing attackers to send SMS commands and listen to the device's surroundings
View Detailsmedical dental records product installs a MySQL database with a blank default password
View Detailshealthcare system for archiving patient images has default passwords for key management and storage databases
View Detailsdatabase product installs admin account with default null password, allowing privileges, as exploited by various worms
View DetailsCWE Relationships
Frequently Asked Questions
What is CWE-1393: Use of Default Password?+
CWE-1393: Use of Default Password is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses default passwords for potentially critical functionality. It is common practice for products to be designed to use default passwords for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, then it makes it easier for attackers to quickly bypass authentication across multiple organizations. There are many lists of default passwords and default-password scanning tools that are easily available from the World Wide Web.
What are the security consequences of Use of Default Password?+
If exploited, CWE-1393 (Use of Default Password) it can compromise Authentication, leading to outcomes such as Gain Privileges or Assume Identity.
How do you prevent or mitigate Use of Default Password?+
Recommended mitigations for CWE-1393 include: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations. Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them. Force the administrator to change the credential upon installation.
Which programming languages are affected by Use of Default Password?+
CWE-1393 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Use of Default Password?+
MITRE documents real CVEs mapped to CWE-1393, including CVE-2022-30270, CVE-2022-2336, CVE-2021-38759, CVE-2021-44480 and CVE-2020-11624. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-1393 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.