CWE-1392 Use of Default Credentials
What this means
SiteShadow flagged use of default credentials (factory usernames/passwords, "admin/admin", hardcoded initial passwords) that can be guessed or found in public documentation.
Why it matters
Default credentials are publicly known and commonly abused.
- Automated compromise: scanners routinely try default passwords.
- Instant admin access in many systems once defaults are found.
- Defaults often linger in staging and then drift into production.
Safer examples
1) Remove default creds and force setup on first run
Require the operator to set a strong password (or create a first user) during initialization.
2) Generate random initial secrets
If you need a bootstrap credential, generate it randomly and display it once, with rotation required.
3) Enforce policy + monitoring
- Block common passwords
- Rate-limit login
- Alert on repeated failed logins
How SiteShadow detects it (high level)
- Flags known default-credential strings and "first-run admin" patterns.
- Uses heuristic matching for "admin/password" pairs in configs and docs-like code.
References
- CWE-1392: https://cwe.mitre.org/data/definitions/1392.html
---