Cyber Resilience

CWE · MITRE source

CWE-1393Use of Default Password

Abstraction: Base · CVEs in our corpus: 43

The product uses default passwords for potentially critical functionality.

It is common practice for products to be designed to use default passwords for authentication. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, then it makes it easier for attackers to quickly bypass authentication across multiple organizations. There are many lists of default passwords and default-password scanning tools that are easily available from the World Wide Web.

Last updated: 20 August 2026 13:14 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • IA-5 Authenticator Management
  • IA-7 Cryptographic Module Authentication
  • PM-16 Threat Awareness Program
  • PR.AA-01
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (3)AI-assisted

Control Title Family Why it addresses this CWE
IA-5Authenticator ManagementIAChanging default authenticators prior to first use prevents use of default passwords.
IA-7Cryptographic Module AuthenticationIARequires authentication that meets guidelines, avoiding default passwords for cryptographic module access.
PM-16Threat Awareness ProgramPMThreat awareness programs disseminate botnet and scanning activity tied to default passwords, driving organizations to change or enforce non-default credentials before mass exploitation occurs.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2023-45249 KEV 9.99.80.53252024-07-24
CVE-2024-29021 7.69.00.20182024-04-18
CVE-2023-32090 7.49.80.00622023-08-07
CVE-2023-24049 7.49.80.00732023-12-04
CVE-2024-29666 7.49.80.00742024-03-25
CVE-2024-50588 7.49.80.00702024-11-08
CVE-2024-51555 7.410.00.00412024-12-05
CVE-2025-26701 7.410.00.00442025-03-11
CVE-2024-30802 7.39.80.00522024-05-14
CVE-2025-22938 7.39.80.00522025-03-31
CVE-2025-27690 7.39.80.00472025-04-10
CVE-2025-8077 7.39.80.00562025-09-17
CVE-2026-244297.39.80.00372026-01-26
CVE-2026-22886 7.39.80.00402026-03-03
CVE-2026-33784 7.39.80.00462026-04-09
CVE-2026-35075 7.39.80.00472026-06-03
CVE-2023-25131 7.29.40.00972023-04-24
CVE-2025-660507.29.80.00342026-01-09
CVE-2026-52697.29.80.00272026-07-14
CVE-2026-165047.29.80.00272026-07-31
CVE-2026-4404 7.19.40.00492026-03-23
CVE-2022-4126 6.89.60.00622023-03-27
CVE-2026-165036.79.10.00252026-07-31
CVE-2024-49559 6.68.80.00462025-03-17
CVE-2025-2766 6.58.80.00302025-06-06