CVE-2025-55049CWE-1394

Use of Default Cryptographic Key (CWE-1394)

Critical · published September 9, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

🚨 Your security could be riding on a default cryptographic key that everyone knows! This vulnerability allows attackers to easily decrypt sensitive data, just like a master key that never got changed! 🔥 Think of it like a hotel that never changes its master key — anyone with that key can waltz into any room at any time without a hitch! In the same way, using a default cryptographic key leaves your sensitive information wide open for anyone to access. An attacker with this knowledge could decrypt and access confidential data, potentially leading to identity theft, financial loss, or data breaches — absolutely devastating consequences for your organization! If this falls into the wrong hands, it can mean game over for your data security.

Put simply

Think of it like a hotel that never changes its master key — anyone with that key can waltz into any room at any time without a hitch! In the same way, using a default cryptographic key leaves your sensitive information wide open for anyone to access. This vulnerability arises from the use of a default cryptographic key, which can be easily guessed by an attacker, allowing them to decrypt sensitive information and bypass security measures.

What to do

An attacker with this knowledge could decrypt and access confidential data, potentially leading to identity theft, financial loss, or data breaches — absolutely devastating consequences for your organization! If this falls into the wrong hands, it can mean game over for your data security. Immediately replace the default cryptographic key with a secure, randomly generated key. Ensure all instances of this vulnerability are patched and review your cryptographic practices to prevent this from happening again. You've got this! By taking these steps, you can tighten your security and protect your data like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-1394 · Use of Default Cryptographic Key
Published
2025-09-09T18:52Z
EPSS history
Timeline
  • 09 SEP 18:52Z
    Use of Default Cryptographic Key (CWE-1394)
    cvelistv5