CWE-258 describes a weakness where an account or configuration uses an empty password. Unlike a complex password crack, an empty password means the system accepts no secret at all, so authentication is effectively bypassed. This often appears in embedded devices, admin tools, or startup scripts where developers leave a credential field blank for convenience, testing, or compatibility.
In cyber security, this is severe because it turns a protected service into an open one. An attacker who reaches the service may gain access to management functions, live data, or device settings without brute force or malware. In camera firmware, an empty-password privileged account on a management interface can expose streams and controls. Defenders should treat empty passwords as a release-blocking defect: enforce non-empty credentials, reject blank logins server-side, audit configuration files, and scan firmware images and account stores for unauthenticated or blank-secret paths.