What CVEs are caused by CWE-1394?

17 recorded CVEs are attributed to CWE-1394, including CVE-2025-41742, CVE-2025-44954, CVE-2024-48956.

What are the consequences of CWE-1394?

Exploiting CWE-1394 can lead to: Gain Privileges or Assume Identity.

Is CWE-1394 actively exploited?

17 recorded CVEs are caused by CWE-1394; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Base weakness

Incomplete

CWE-1394: Use of Default Cryptographic Key

The product uses a default cryptographic key for potentially critical functionality.

Last updated May 1, 2026

17

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

It is common practice for products to be designed to use default keys. The rationale is to simplify the manufacturing process or the system administrator's task of installation and deployment into an enterprise. However, if admins do not change the defaults, it is easier for attackers to bypass authentication quickly across multiple organizations.

Real-world CVEs

17 recorded CVEs are caused by CWE-1394 (Use of Default Cryptographic Key). The highest-severity and most recent are shown first. 5 new CWE-1394 CVEs have been recorded so far in 2026 (6 in 2025).

CVE-2025-41744

Sprecher Automation: SPRECON-E series has static default key material for TLS connections

Critical · CVSS 9.1 · EPSS 29th

2025-12-02

CVE-2025-55049

Critical · CVSS 9.1 · EPSS 20th

2025-09-09

CVE-2024-1275

Critical · CVSS 9.1 · EPSS 31th

2024-05-31

CVE-2024-29037

Critical · CVSS 9.1 · EPSS 45th

2024-03-20

CVE-2023-6451

High · CVSS 8.6 · EPSS 41th

2024-02-16

CVE-2026-54887

DTLS server cookie bypass during startup window due to empty initial cookie secret

Medium · CVSS 6.3 · EPSS 15th

2026-07-02

CVE-2026-2215

rachelos WeRSS we-mp-rss JWT auth.py default key

Medium · CVSS 6.3 · EPSS 19th

2026-02-09

CVE-2026-5039

Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N

Medium · CVSS 6.1 · EPSS 3th

2026-04-23

CVE-2026-20709

Medium · CVSS 5.8 · EPSS 2th

2026-04-08

Showing 12 of 17 recorded CWE-1394 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-1394 vulnerabilities

Common consequences

What can happen when CWE-1394 is exploited.

Gain Privileges or Assume Identity

Affects: Authentication

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

How to prevent it

Practical mitigations for CWE-1394, grouped by where in the lifecycle they apply.

Requirements

Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.

Effectiveness: High

Architecture and Design

Force the administrator to change the credential upon installation.

Effectiveness: High

Installation

Operation

The product administrator could change the defaults upon installation or during operation.

Effectiveness: Moderate

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2018-3825 — cloud cluster management product has a default master encryption key
CVE-2016-1561 — backup storage product has a default SSH public key in the authorized_keys file, allowing root access
CVE-2010-2306 — Intrusion Detection System (IDS) uses the same static, private SSL keys for multiple devices and installations, allowing decryption of SSL traffic

Frequently asked questions

Common questions about CWE-1394.

What is CWE-1394?: The product uses a default cryptographic key for potentially critical functionality.
What CVEs are caused by CWE-1394?: 17 recorded CVEs are attributed to CWE-1394, including CVE-2025-41742, CVE-2025-44954, CVE-2024-48956.
How do you prevent CWE-1394?: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
What are the consequences of CWE-1394?: Exploiting CWE-1394 can lead to: Gain Privileges or Assume Identity.
Is CWE-1394 actively exploited?: 17 recorded CVEs are caused by CWE-1394; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-1394

Get alerted the moment a new CWE-1394 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing