CWE-1394 Use of Default Cryptographic Key
baseThe product uses a default cryptographic key for potentially critical functionality.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (25)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-92777US | medium6.4 | — | ||
A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary… | ||||
| CVE-2026-111367US | medium6.5 | — | ||
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the… | ||||
| CVE-2020-37281US | high8.1 | — | ||
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed… | ||||
| CVE-2026-72895DE | high7.7 | — | ||
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G… | ||||
| CVE-2026-107177US | medium5.9 | — | ||
Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the d… | ||||
| CVE-2026-75870US | — | — | ||
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret.
The session keyword freezes its options… | ||||
| CVE-2026-54887US | medium4.8 | — | ||
Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verific… | ||||
| CVE-2026-5039US | high8.8 | — | ||
TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if d… | ||||
| CVE-2026-20709US | — | — | ||
Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J Series, Intel(R) Celeron(R) Processor N Serie… | ||||
| CVE-2026-2215US | — | — | ||
A vulnerability was detected in rachelos WeRSS we-mp-rss up to 1.4.8. This issue affects some unknown processing of the file core/auth.py of the component JWT Handler. Performing a… | ||||
| CVE-2026-25815US | — | — | ||
Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exploited in the wild from 2025-12-16 through 2026 (by default,… | ||||
| CVE-2025-41744US | — | — | ||
Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confid… | ||||
| CVE-2025-41742US | — | — | ||
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows… | ||||
| CVE-2025-55049US | — | — | ||
Use of Default Cryptographic Key (CWE-1394) | ||||
| CVE-2025-44954US | critical9.8 | — | ||
RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. | ||||
| CVE-2025-1688US | — | — | ||
Milestone Systems has discovered a
security vulnerability in Milestone XProtect installer that resets system
configuration password after the upgrading from older versions using sp… | ||||
| CVE-2025-26849US | — | — | ||
There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that contain sensitive informat… | ||||
| CVE-2024-48956US | — | — | ||
Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote co… | ||||
| CVE-2024-11619US | high8.1 | — | ||
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token… | ||||
| CVE-2024-10748US | medium4.7 | — | ||
A vulnerability, which was classified as problematic, has been found in Cosmote Greece What's Up App 4.47.3 on Android. This issue affects some unknown processing of the file gr/de… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan