Use of Hard-coded Credentials
CWE-798
The product contains hard-coded credentials, such as a password or cryptographic key.
We track 711 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 12 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible. In Windows environments, the Encrypted File System (EFS) may provide some protection.
- Architecture and Design: For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a first login mode that requires the user to enter a unique strong password or key.
- Architecture and Design: If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Latest Use of Hard-coded Credentials vulnerabilities
- 7.8 High severity
FortiTester: Use of Hard-coded Credentials
A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to access the database via shell commands.
- 9.8 Critical severity
IRM Next Generation: Use of Hard-coded Credentials
The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useless.
- 7.7 High severity
IRM Next Generation: Use of Hard-coded Credentials
The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
- 8.8 High severity
IRM Next Generation: Use of Hard-coded Credentials
The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routin
- 8.8 High severity
Archer C50: Use of Hard-coded Credentials
Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to exe
- 8.4 High severity
SEL-5037 SEL Grid Configurator: Use of Hard-coded Credentials
Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. See Instruction Manual Appendix A and Appendix E dated 20230615 for more details. This issue affects SEL-
- 8.4 High severity
MBTS Base Radio: Use of Hard-coded Credentials
Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be changed or dis
- 9.8 Critical severity
MBTS Site Controller: Use of Hard-coded Credentials
Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technicians to diagnose and configure the device, accepts a hard-coded backdoor password that cannot be chan
- 9.8 Critical severity
SpotCam FHD 2: Use of Hard-coded Credentials
SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
- 9.8 Critical severity
SpotCam FHD 2: Use of Hard-coded Credentials
SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt servic
- 7.5 High severity
netmaker: Use of Hard-coded Credentials
Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.1
- 8.8 High severity
LMS5xx: Use of Hard-coded Credentials
The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functionality of the device.
- 7.5 High severity
EdgeConnect SD-WAN Orchestrator: Use of Hard-coded Credentials
EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations. This vulnerability could allow an attacker to spoof the SSH host signature and thereby masquerade as
- 9.8 Critical severity
Intelligent Broadband Subscriber Gateway: Use of Hard-coded Credentials
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH service. The cleartext password corresponding to the $1$4Tmm01jl$7HRvcW.bz7uGmX9hiQWvR hash was not determ
- 9.8 Critical severity
NPort IAW5000A-I/O Series: Use of Hard-coded Credentials
NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and integrity of the affected device. This vulnerability is attributed to the presence of a hardcoded key,
- 9.8 Critical severity
iBoot PDU: Use of Hard-coded Credentials
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage t
- 7.5 High severity
voip_phones: Use of Hard-coded Credentials
An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive info
- 7.5 High severity
voip_phones: Use of Hard-coded Credentials
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information.
- 7.2 High severity
WP 6070-WVPS: Use of Hard-coded Credentials
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cryptographic keys allowing the attacker to create valid session cookies. These session-cookies created
- 9.8 Critical severity
Connected Io: Use of Hard-coded Credentials
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on b
- 9.8 Critical severity
Control Id Idsecure: Use of Hard-coded Credentials
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- 7.5 High severity
IP-HE950E: Use of Hard-coded Credentials
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as f
- 7.5 High severity
GMS: Use of Hard-coded Credentials
Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- 9.1 Critical severity
SmartBPM.NET: Use of Hard-coded Credentials
SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.
- 9.8 Critical severity
SmartBPM.NET: Use of Hard-coded Credentials
SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
- 7.8 High severity
miniserver_go_gen_2: Use of Hard-coded Credentials
The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calculate the root password and escalate privileges.
- 8.8 High severity
MegaRAC_SPx: Use of Hard-coded Credentials
AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
- 9.8 Critical severity
MegaRAC_SPx: Use of Hard-coded Credentials
AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability.
- 9.1 Critical severity
website: Exposure of Sensitive Information to an Unauthorized Actor
`tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of the church's project. This sensitive information was unintentionally committed and subsequently expose
- 9.8 Critical severity
R-SeeNet: Use of Hard-coded Credentials
Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that cannot be changed by users.
- 7.5 High severity
Enphase Installer Toolkit: Use of Hard-coded Credentials
Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.
- 7.0 High severity
Asika Airscale Firmware: Use of Hard-coded Credentials
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed) default SSH public/private key values that are specific to a network operator. As a result, the CSP
- 9.8 Critical severity
OTCMS: Use of Hard-coded Credentials
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the pu
- 8.2 High severity
FactoryTalk System Services: Use of Hard-coded Credentials
Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lead to privilege escalation. This vulnerability may allow a local, authenticated non-admin user to genera
- 7.2 High severity
Hitron CODA-5310: Use of Hard-coded Credentials
Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption.
- 7.5 High severity
MELSEC iQ-R Series EtherNet/IP module RJ71EIP91: Use of Hard-coded Credentials
Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded pa
- 9.8 Critical severity
SPRECON-E CPU PU243x: Use of Hard-coded Credentials
Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines.
- 9.8 Critical severity
Myvigor: Use of Hard-coded Credentials
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers t
- 8.8 High severity
DataSpider Servista: Use of Hard-coded Credentials
DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic
- 7.2 High severity
SolarView Compact: Use of Hard-coded Credentials
Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allow a remote authenticated attacker to login the affected product with an administrative privilege and