CVE-2024-12728

A.5.17 mandates generation of non-guessable unique credentials, immediate change of defaults/temporary secrets, strong password enforcement, no reuse, blocking of compromised passwords, and secure transmission/storage; this stops exploitation of weak/guessable/default credentials for most but not all cases in CWE-1391 (e.g. leaves some non-password credential forms or post-compromise reuse outside its explicit scope).

Restricts privileged accounts but does not explicitly address default or hard-coded credentials for those accounts.

Requires security activities throughout the SDLC that can catch weak credentials, but does not mandate their elimination.

Secure-coding rules can prohibit hard-coded passwords, yet coverage depends on specific coding standards adopted.

Security testing can discover weak credentials, but does not guarantee they are prevented by design.

A.8.5 mandates strong, multi-factor, non-guessable authentication techniques (with brute-force protection, no cleartext, etc.) that stop weak credentials from being successfully exploited; the bounded remainder is hard-coded/default credentials inside non-interactive product components where no human or session authentication occurs at all.