1. Home
  2. CWE Database
  3. CWE-1391
Class · High

CWE-1391: Use of Weak Credentials

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

CWE-1391 · Class Level ·15 CVEs ·1 Mitigations

Description

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

By design, authentication protocols try to ensure that attackers must perform brute force attacks if they do not know the credentials such as a key or password. However, when these credentials are easily predictable or even fixed (as with default or hard-coded passwords and keys), then the attacker can defeat the mechanism without relying on brute force. Credentials may be weak for different reasons, such as: Even if a new, unique credential is intended to be generated for each product installation, if the generation is predictable, then that may also simplify guessing attacks.

Potential Impact

Access Control

Bypass Protection Mechanism

Demonstrative Examples

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple OT products used weak credentials.

Mitigations & Prevention

Architecture and DesignOperation Moderate

When the user changes or sets a password, check the password against a database of already compromised or breached passwords. These passwords are likely to be used in password guessing attacks.

Real-World CVE Examples

CVE IDDescription
[REF-1374]Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generat
CVE-2022-30270Remote Terminal Unit (RTU) uses default credentials for some SSH accounts
CVE-2022-29965Distributed Control System (DCS) uses a deterministic algorithm to generate utility passwords
CVE-2022-30271Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used in typical deployments
CVE-2021-38759microcontroller board has default password, allowing admin access
CVE-2021-41192data visualization/sharing package uses default secret keys or cookie values if they are not specified in environment variables
CVE-2020-8994UART interface for AI speaker uses empty password for root shell
CVE-2020-27020password manager does not generate cryptographically strong passwords, allowing prediction of passwords using guessable details such as time of generation
CVE-2020-8632password generator for cloud application has small length value, making it easier for brute-force guessing
CVE-2020-5365network-attached storage (NAS) system has predictable default passwords for a diagnostics/support account
CVE-2020-5248IT asset management app has a default encryption key that is the same across installations
CVE-2018-3825cloud cluster management product has a default master encryption key
CVE-2012-3503Installation script has a hard-coded secret token value, allowing attackers to bypass authentication
CVE-2010-2306Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic
CVE-2001-0618Residential gateway uses the last 5 digits of the 'Network Name' or SSID as the default WEP key, which allows attackers to get the key by sniffing the SSID, which is sent in the clear

CWE-1390: Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does ...

Taxonomy Mappings

  • ISA/IEC 62443: Part 2-4 — Req SP.09.02 RE(1)
  • ISA/IEC 62443: Part 4-1 — Req SR-3 b)
  • ISA/IEC 62443: Part 4-1 — Req SI-2 b)
  • ISA/IEC 62443: Part 4-1 — Req SI-2 d)
  • ISA/IEC 62443: Part 4-1 — Req SG-3 d)
  • ISA/IEC 62443: Part 4-1 — Req SG-6 b)
  • ISA/IEC 62443: Part 4-2 — Req CR 1.1
  • ISA/IEC 62443: Part 4-2 — Req CR 1.2
  • ISA/IEC 62443: Part 4-2 — Req CR 1.5
  • ISA/IEC 62443: Part 4-2 — Req CR 1.7
  • ISA/IEC 62443: Part 4-2 — Req CR 1.8
  • ISA/IEC 62443: Part 4-2 — Req CR 1.9
  • ISA/IEC 62443: Part 4-2 — Req CR 1.14
  • ISA/IEC 62443: Part 4-2 — Req CR 2.1
  • ISA/IEC 62443: Part 4-2 — Req CR 4.3
  • ISA/IEC 62443: Part 4-2 — Req CR 7.5

Frequently Asked Questions

What is CWE-1391?

CWE-1391 (Use of Weak Credentials) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

How can CWE-1391 be exploited?

Attackers can exploit CWE-1391 (Use of Weak Credentials) to bypass protection mechanism. This weakness is typically introduced during the Requirements, Architecture and Design, Installation, Operation phase of software development.

How do I prevent CWE-1391?

Key mitigations include: When the user changes or sets a password, check the password against a database of already compromised or breached passwords. These passwords are likely to be used in password guessing attack

What is the severity of CWE-1391?

CWE-1391 is classified as a Class-level weakness (High abstraction). It has been observed in 15 real-world CVEs.