目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1393 类漏洞列表 33

CWE-1393 类弱点 33 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1393 指软件在关键功能中使用默认密码的漏洞。攻击者常利用此缺陷，通过尝试常见默认凭据直接获取系统访问权限，从而绕过身份验证机制。为防范此类风险，开发者应在产品出厂或部署时强制要求用户修改默认密码，或在首次登录时实施不可跳过的密码重置流程，确保所有账户均使用高强度且唯一的凭证，从根本上消除因默认配置导致的安全隐患。

MITRE CWE 官方描述
CWE：CWE-1393 使用默认密码（Use of Default Password） 英文：该产品对潜在的关键功能使用了默认密码。 产品在设计时采用默认密码进行认证是一种常见做法。其理由是为了简化制造过程或系统管理员在企业环境中进行安装和部署的任务。然而，如果管理员未更改默认密码，则攻击者将更容易快速绕过多个组织的认证。从万维网上可以轻易获取许多默认密码列表以及默认密码扫描工具。
常见影响 (1)
Authentication Gain Privileges or Assume Identity
缓解措施 (4)
Requirements Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
Effectiveness: High
Documentation Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
Effectiveness: Limited
Architecture and Design Force the administrator to change the credential upon installation.
Effectiveness: High
Installation, Operation The product administrator could change the defaults upon installation or during operation.
Effectiveness: Moderate
代码示例 (1)
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-28094 Pegasystem PEGA Platform 安全漏洞 — Pega Platform 8.1 High 2023-06-22
CVE-2023-25131 PowerPanel Business 安全漏洞 — PowerPanel Business Local / Remote 9.4 Critical 2023-04-24
CVE-2022-4126 ABB RCCMD 授权问题漏洞 — RCCMD 9.6 Critical 2023-03-27

CWE-1393 是常见的弱点类别，本平台收录该类弱点关联的 33 条 CVE 漏洞。