Security Resilience

CWE · MITRE source

CWE-521Weak Password Requirements

Abstraction: Base · CVEs in our corpus: 263

The product does not require that users should have strong passwords.

Last updated: 14 October 2026 20:41 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 6 mapping(s) from 2 framework(s): ATT&CK 4 (partial) · STIG rhel 7 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • IA-1 Policy and Procedures
  • IA-5 Authenticator Management
  • PM-15 Security and Privacy Groups and Associations
  • PM-3 Information Security and Privacy Resources
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 2 hardening rules · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V6.2.4
  • V6.2.12
  • V6.4.1

NIST 800-53 r5 controls PROPOSED for this weakness (8)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
IA-5Authenticator ManagementIAgraded full Ensuring authenticators have sufficient strength of mechanism for intended use addresses weak password requirements.
IA-1Policy and ProceduresIAIA policy establishes password requirements, directly addressing weak password requirements.
PM-15Security and Privacy Groups and AssociationsPMFacilitated training and awareness of current practices improves definition and enforcement of sufficiently strong password requirements.
PM-3Information Security and Privacy ResourcesPMDedicated security resources support deployment of strong authentication systems and enforcement of robust password policies.
CM-6Configuration SettingsCMConfiguration settings can define and enforce strong password requirements to avoid weak policies.
PL-9Central ManagementPLOrganization-wide password and authentication policies are applied uniformly, preventing weak local password requirements.
RA-5Vulnerability Monitoring and ScanningRAVulnerability scans assess password policies and weak credential requirements against benchmarks.
SA-5System DocumentationSAUser documentation on maintaining security includes password requirements, directly mitigating weak password policies.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2019-17444 9.89.80.69452020-10-12
CVE-2017-3186 8.09.80.06092017-12-16
CVE-2018-1000134 7.99.80.04652018-03-16
CVE-2019-18988 KEV 7.97.00.04712020-02-07
CVE-2017-7903 7.89.80.02762017-06-30
CVE-2017-12861 7.89.80.03342017-10-10
CVE-2017-14189 7.89.80.02782017-11-29
CVE-2020-11966 7.89.80.03072020-04-21
CVE-2018-1372 7.79.80.02152018-02-27
CVE-2017-1601 7.79.80.02402018-05-02
CVE-2018-19064 7.79.80.01992018-11-07
CVE-2019-9950 7.79.80.02302019-04-24
CVE-2019-7488 7.79.80.01892019-12-23
CVE-2020-26201 7.79.80.02442020-12-10
CVE-2020-29591 7.79.80.02652020-12-11
CVE-2021-43036 7.79.80.01922021-12-06
CVE-2022-1775 7.79.80.02242022-05-20
CVE-2022-1668 7.79.80.02212022-06-24
CVE-2017-1196 7.69.80.01662017-06-07
CVE-2017-9853 7.69.80.01722017-08-05
CVE-2017-1221 7.69.80.01582017-11-13
CVE-2018-12925 7.69.80.01462018-06-28
CVE-2019-7674 7.69.80.01352019-02-09
CVE-2019-9123 7.69.80.01502019-02-25
CVE-2019-13918 7.69.80.01512019-09-13