Home/CWE/Initialization of a Resource with an Insecure Default
Weakness

Initialization of a Resource with an Insecure Default

CWE-1188 · Base · Incomplete

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-1419 · Incorrect Initialization of Resource
ChildOfCWE-344 · Use of Invariant Value in Dynamically Changing Context
ChildOfCWE-665 · Improper Initialization
Children (more specific)
ParentOfCWE-453 · Insecure Default Variable Initialization
◆

Attack Patterns (CAPEC)

1
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-665Exploitation of Thunderbolt Protection Flaws
⚠

CVEs With This Weakness

309
A sample of the 309 CVEs tagged with this weakness.
CVECVE-2026-6866
CVECVE-2026-6043
CVECVE-2026-44670
CVECVE-2026-44588
CVECVE-2026-44338
CVECVE-2026-44109
CVECVE-2026-43892
CVECVE-2026-43581
CVECVE-2026-43527
CVECVE-2026-41931
CVECVE-2026-41679
CVECVE-2026-41432
◉

Nuclei Scanner Templates

11
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalAirflow Experimental <1.10.11 - REST API Auth Bypass
criticalTieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access
criticalApache Superset - Authentication Bypass
criticalCouchDB Erlang Distribution - Remote Command Execution
highDbGate Anonymous Access - Detection
highMotionEye Config Info Disclosure
highApache ActiveMQ 6.x < 6.1.2 - Broken Access Control
mediumMage AI - Insecure Default Authentication Setup
mediumRedash Setup Configuration - Default Secrets Disclosure
mediumPowerJob V4.3.1 - Authentication Bypass
mediumFastify Swagger-UI - Information Disclosure
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin