CWE：CWE-1392 使用默认凭证 (Use of Default Credentials)
该产品对潜在的关键功能使用了默认凭证 (default credentials)（例如密码或加密密钥）。
产品在设计时采用默认密钥、密码或其他认证机制是一种常见做法。其理由是简化制造流程或系统管理员在企业环境中进行安装和部署的任务。然而，如果管理员未更改这些默认设置，攻击者将更容易在多个组织中快速绕过认证。
常见影响 (1)
AuthenticationGain Privileges or Assume Identity
缓解措施 (3)
RequirementsProhibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Effectiveness: High
Architecture and DesignForce the administrator to change the credential upon installation.
Effectiveness: High
Installation, OperationThe product administrator could change the defaults upon installation or during operation.
Effectiveness: Moderate
代码示例 (1)
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…