CWE-1394: Use of Default Cryptographic Key
The product uses a default cryptographic key for potentially critical functionality.
A kind of CWE-1392 Use of Default Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- chartbrew Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET 9.8 Critical
- about time technologies herowatch go About Time Technologies｜Herowatch Go - Security Misconfiguration 8.5 High
- xianhc ape-volo-admin ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass 9.3 Critical
- yincongcyincong musebot MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key 9.3 Critical
- lenovo idea tab pro (tb373fu), idea tab/ lenovo tab k11 gen 2 (tb336fu), idea tab/ lenovo tab k11 gen 2 (tb336fu/tb336zu) +24 more +26 more A potential vulnerability was reported in some Lenovo Tablets that could allow a user with... 5.4 Medium
- aapanel billionmail BillionMail through 4.9 Forgeable JWTs via Default Signing Key 6.9 Medium
- gravitee api management Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass 9.2 Critical
- siemens simatic ipc bx-21a, simatic ipc rw-543a, simatic ipc227g / ipc277g / ipc277g pro / ipc327g / ipc377g +2 more A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC... 8.4 High
- expressgateway express-gateway Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth Tokens 7.4 High
- No product listed Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret 9.1 Critical
- erlang otp, erlang\/otp, erlang\/ssl +2 more DTLS server cookie bypass during startup window due to empty initial cookie secret 6.3 Medium
- tp-link tl-wr841n firmware, tp-link systems inc. tl-wl841n v13 +1 more Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N 6.1 Medium
- No product listed Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver... 5.8 Medium
- rachelos werss we-mp-rss rachelos WeRSS we-mp-rss JWT auth.py default key 6.3 Medium
- fortinet fortios Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device... 3.2 Low
- sprecher automation sprecon-e-c, sprecon-e-p, sprecon-e-t3 +3 more +5 more Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components 9.8 Critical
- sprecher automation sprecon-e-c, sprecon-e-p, sprecon-e-t3 +3 more +5 more Sprecher Automation: SPRECON-E series has static default key material for TLS connections 9.1 Critical
- baicells neutrino430 Use of Default Cryptographic Key (CWE-1394) 9.1 Critical
- ruckus smartzone, commscope ruckus smartzone firmware +1 more RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root... 9.0 Critical
- milestone systems xprotect vms System configuration password reset 5.5 Medium
- docusnap There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. 4.3 Medium
- No product listed Serviceware Processes 6.0 through 7.3 allows attackers without valid authentication to send a... 9.8 Critical
- macrozheng mall macrozheng mall JWT Token default key 2.3 Low
- cosmote greece what's up app, cosmote what\'s up, cosmotegreece whatsup app +2 more Cosmote Greece What's Up App Realm Database RealmDB.java default key 2.0 Low
- baxter welch allyn connex spot monitor Vulnerability in Baxter Welch Allyn Connex Spot Monitor 9.1 Critical
- acryldata datahub-helm Default secret use for initial deployment 9.1 Critical
- alayacare procura, procura portal +1 more Publicly Known Cryptographic Machine Key In Procura Portal Application 8.6 High