The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
MITRE ATT&CK techniques associated with this weakness class (mapped via MITRE CAPEC). A vulnerability of this type could let an adversary carry out:
A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.
Stay in even after reboots, patches, or credential changes.
Startup hooks, scheduled tasks, config, and accounts the attacker can plant a backdoor in.
Integrity monitoring of code, config, and scheduled tasks; short-lived credentials.
Steal passwords, tokens, keys, and session material.
Passwords, API keys, session tokens, SSH/TLS keys, and secrets in memory, env, or config.
Secret managers, short-lived tokens, and no secrets in code/env/logs.
This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.