Use of Default Cryptographic Key
CWE-1394
The product uses a default cryptographic key for potentially critical functionality.
We track 12 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9.
How this weakness is prevented
- Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Architecture and Design: Force the administrator to change the credential upon installation.
- Installation Operation: The product administrator could change the defaults upon installation or during operation.
Latest Use of Default Cryptographic Key vulnerabilities
- 9.8 Critical severity
chartbrew: Use of Default Cryptographic Key
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default
- 7.8 High severity
Herowatch Go: Use of Default Cryptographic Key
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
- 9.8 Critical severity
ape-volo-admin: Use of Default Cryptographic Key
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to t
- 9.8 Critical severity
MuseBot: Use of Default Cryptographic Key
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_i
- 7.7 High severity
SIMATIC IPC BX-21A: Use of Default Cryptographic Key
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the
- 8.8 High severity
TL-WL841N v13: Use of Default Cryptographic Key
TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit
- 9.1 Critical severity
SPRECON-E-C: Use of Default Cryptographic Key
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.
- 9.8 Critical severity
SPRECON-E-C: Use of Default Cryptographic Key
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any devi
- 8.1 High severity
mall: Use of Default Cryptographic Key
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The comple
- 9.1 Critical severity
Welch Allyn Connex Spot Monitor: Use of Default Cryptographic Key
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.
- 9.1 Critical severity
datahub-helm: Use of Default Cryptographic Key
datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial depl
- 7.5 High severity
Procura Portal: Improper Authentication
Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication cookies and bypass the application's authentication mechanisms.