CWE-1394: Use of Default Cryptographic Key
The product uses a default cryptographic key for potentially critical functionality.
18 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-41742 — Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
- CVE-2024-48956 — Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially craft
- CVE-2025-55049 — Use of Default Cryptographic Key (CWE-1394)
- CVE-2025-41744 — Sprecher Automation: SPRECON-E series has static default key material for TLS connections
- CVE-2024-29037 — Default secret use for initial deployment
- CVE-2024-1275 — Vulnerability in Baxter Welch Allyn Connex Spot Monitor
- CVE-2025-44954 — RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.
- CVE-2026-75870 — Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
- CVE-2026-2215 — rachelos WeRSS we-mp-rss JWT auth.py default key
- CVE-2025-1688 — System configuration password reset
- CVE-2026-54887 — DTLS server cookie bypass during startup window due to empty initial cookie secret
- CVE-2026-5039 — Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N
- CVE-2026-20709 — Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(
- CVE-2025-26849 — There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be use
- CVE-2026-25815 — Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exp
- CVE-2024-10748 — Cosmote Greece What's Up App Realm Database RealmDB.java default key
Recently published
- CVE-2026-75870 — Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
- CVE-2026-54887 — DTLS server cookie bypass during startup window due to empty initial cookie secret
- CVE-2026-5039 — Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N
- CVE-2026-20709 — Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(
- CVE-2026-2215 — rachelos WeRSS we-mp-rss JWT auth.py default key
- CVE-2026-25815 — Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device configuration files, as exp
- CVE-2025-41742 — Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
- CVE-2025-41744 — Sprecher Automation: SPRECON-E series has static default key material for TLS connections
- CVE-2025-55049 — Use of Default Cryptographic Key (CWE-1394)
- CVE-2025-44954 — RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account.
- CVE-2025-1688 — System configuration password reset
- CVE-2025-26849 — There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be use
- CVE-2024-48956 — Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially craft
- CVE-2024-10748 — Cosmote Greece What's Up App Realm Database RealmDB.java default key
- CVE-2024-1275 — Vulnerability in Baxter Welch Allyn Connex Spot Monitor
- CVE-2024-29037 — Default secret use for initial deployment