CWE-1394Use of Default Cryptographic Key

Abstraction: Base · CVEs in our corpus: 18

The product uses a default cryptographic key for potentially critical functionality.

It is common practice for products to be designed to use default keys. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.

Last updated: 22 August 2026 20:22 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-01
PR.AA-01
SC-12 Cryptographic Key Establishment and Management
CM-6 Configuration Settings

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2024-48956`	7.5	9.8	0.0086	2024-12-09
`CVE-2025-41742`	7.3	9.8	0.0045	2025-12-02
`CVE-2024-29037`	6.9	9.1	0.0060	2024-03-20
`CVE-2025-55049`	6.8	9.1	0.0030	2025-09-09
`CVE-2025-41744`	6.8	9.1	0.0040	2025-12-02
`CVE-2025-44954`	6.4	9.0	0.0075	2025-08-04
`CVE-2023-6451`	6.3	8.6	0.0053	2024-02-16
`CVE-2026-5039`	6.3	8.8	0.0013	2026-04-23
`CVE-2026-20709`	4.5	6.6	0.0011	2026-04-08
`CVE-2024-11619`	4.2	5.0	0.0070	2024-11-22
`CVE-2025-1688`	4.0	5.5	0.0023	2025-04-15
`CVE-2026-54887`	3.8	4.8	0.0024	2026-07-02
`CVE-2025-26849`	3.4	4.3	0.0024	2025-03-04
`CVE-2026-2215`	3.2	3.7	0.0027	2026-02-09
`CVE-2026-25815`	2.5	3.2	0.0011	2026-02-05
`CVE-2024-10748`	2.3	2.5	0.0026	2024-11-04