CWE-453: Insecure Default Variable Initialization
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
Last updated
Overview
CWE-453 (Insecure Default Variable Initialization) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
18 recorded CVEs are caused by CWE-453 (Insecure Default Variable Initialization). The highest-severity and most recent are shown first. 4 new CWE-453 CVEs have been recorded so far in 2026 (2 in 2025).
- CVE-2026-0082Critical · CVSS 10.0 · EPSS 5th2026-06-17
- CVE-2025-47945
Donetick Has Weak Default JWT Secret
Critical · CVSS 9.8 · EPSS 52th2025-05-17 - CVE-2021-27426Critical · CVSS 9.8 · EPSS 68th2022-03-23
- CVE-2026-92950
vm2 before 3.11.7 Sandbox Escape via CLI require
Critical · CVSS 9.3 · EPSS 9th2026-09-17 - CVE-2024-21411High · CVSS 8.8 · EPSS 85th2024-03-12
- CVE-2024-41255
Filestash configured to skip TLS certificate verification when using the FTPS protocol
High · CVSS 8.7 · EPSS 16th2024-07-31 - CVE-2024-49120High · CVSS 8.1 · EPSS 65th2024-12-10
- CVE-2022-3262High · CVSS 8.1 · EPSS 55th2022-12-08
- CVE-2025-48563High · CVSS 7.8 · EPSS 0th2025-09-04
- CVE-2023-27516High · CVSS 7.8 · EPSS 43th2023-10-12
- CVE-2026-103577
Microsoft QUIC Security Feature Bypass Vulnerability
High · CVSS 7.5 · EPSS 43th2026-10-13 - CVE-2022-46831Medium · CVSS 6.6 · EPSS 40th2022-12-08
Showing 12 of 18 recorded CWE-453 CVEs. Get an alert for each new one, with AI-written analysis and fixes.
Monitor CWE-453 vulnerabilitiesCommon consequences
What can happen when CWE-453 is exploited.
Modify Application Data
Affects: Integrity
An attacker could gain access to and modify sensitive data or system information.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-453, grouped by where in the lifecycle they apply.
Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Code examples
MITRE examples of the weakness in code.
This code attempts to login a user using credentials from a POST request:
Safe example
...
$user = $_POST['user'];Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2022-36349 — insecure default variable initialization in BIOS firmware for a hardware board allows DoS
Terminology & mappings
Mapped taxonomies
- PLOVER: Insecure default variable initialization
Frequently asked questions
Common questions about CWE-453.
- What is CWE-453?
- The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
- What CVEs are caused by CWE-453?
- 18 recorded CVEs are attributed to CWE-453, including CVE-2026-0082, CVE-2025-47945, CVE-2021-27426.
- How do you prevent CWE-453?
- Disable or change default settings when they can be used to abuse the system. Since those default settings are shipped with the product they are likely to be known by a potential attacker who is familiar with the product. For instance, default credentials should be changed or the associated accounts should be disabled.
- How is CWE-453 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-453?
- Exploiting CWE-453 can lead to: Modify Application Data.
- Is CWE-453 actively exploited?
- 18 recorded CVEs are caused by CWE-453; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-453) (opens in a new tab)
- CWE-453 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Track CWE-453 CVEs
Get an alert when a new CWE-453 CVE affects your products, with AI-written analysis and remediation steps.