Use of Hard-coded Credentials
CWE-798
The product contains hard-coded credentials, such as a password or cryptographic key.
We track 711 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 12 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible. In Windows environments, the Encrypted File System (EFS) may provide some protection.
- Architecture and Design: For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a first login mode that requires the user to enter a unique strong password or key.
- Architecture and Design: If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Latest Use of Hard-coded Credentials vulnerabilities
- 9.8 Critical severity
MXsecurity Series: Use of Hard-coded Credentials
MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs.
- 9.8 Critical severity
Cp3 Firmware: Cleartext Transmission of Sensitive Information
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.
- 7.5 High severity
Cp3 Firmware: Inadequate Encryption Strength
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the expo
- 7.8 High severity
FortiNAC: Use of Hard-coded Credentials
A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shel
- 9.8 Critical severity
Iuclid: Use of Hard-coded Credentials
European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5.
- 9.8 Critical severity
Sage 300: Use of Hard-coded Credentials
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connect
- 7.5 High severity
Sage 300: Use of Hard-coded Credentials
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers t
- 7.5 High severity
Sage 300: Use of Hard-coded Credentials
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive info
- 9.8 Critical severity
Sage 300: Use of Hard-coded Credentials
The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables.
- 9.8 Critical severity
Code Dx: Use of Hard-coded Credentials
Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by crafting a custom "Remember Me" token. This is possible due to the use of a hard-coded cipher which was u
- 7.8 High severity
Zoho ManageEngine Multiple Products: Use of Hard-coded Credentials
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escal
- 9.8 Critical severity
Fighting Cock Information System: Use of Hard-coded Credentials
An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials.
- 7.2 High severity
Personal Weather Station Dashboard: Use of Hard-coded Credentials
PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyw
- 7.8 High severity
Wolt Delivery: Food and more: Use of Hard-coded Credentials
Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attacker to obtain the hard-coded API key via reverse-engineering the application binary.
- 10.0 Critical severity
Smart Alarm NXAL-100: Use of Hard-coded Credentials
The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server (MQTT) server and the
- 9.8 Critical severity
UniData: Improper Authentication
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypa
- 9.8 Critical severity
Osprey Pump Controller: Use of Hard-coded Credentials
Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface configuration. The user is not visible in Usernames and Passwords menu list of the application and t
- 9.8 Critical severity
Element backup: Use of Hard-coded Credentials
Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.
- 8.1 High severity
CloudPanel: Use of Hard-coded Credentials
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor thi
- 9.8 Critical severity
Machineselector: Use of Hard-coded Credentials
A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin panel Propiusadmin.php, which allows taking control of the affected system.
- 9.8 Critical severity
PanIndex: Use of Hard-coded Credentials
PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JWT key to sign JWT token and perform any actions as a user with admin privileges. Version 3.1.3 has a p
- 9.8 Critical severity
SS1 and Rakuraku PC Cloud: Use of Hard-coded Credentials
Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to obtain the password of the debug tool and execute it. As a result of exploiting this vulnerability with C
- 9.8 Critical severity
gradio: Use of Hard-coded Credentials
Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=T
- 8.1 High severity
Thingsboard: Use of Hard-coded Credentials
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application serve
- 9.8 Critical severity
Smartserver: Cleartext Storage of Sensitive Information
Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control
- 9.1 Critical severity
Global Facilities Management Software: Use of Hard-coded Credentials
Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impact availability, confidentiality, accessibility and dependability of electronic key boxes.
- 9.8 Critical severity
T8 Firmware: Use of Hard-coded Credentials
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.
- 7.5 High severity
Ca300-poe Firmware: Use of Hard-coded Credentials
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.
- 9.8 Critical severity
N200re-v5 Firmware: Use of Hard-coded Credentials
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
- 7.8 High severity
APC Easy UPS Online Monitoring Software: Use of Hard-coded Credentials
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2
- 9.8 Critical severity
Nova 227: Use of Hard-coded Credentials
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmwa
- 8.8 High severity
Cisco Industrial Network Director: Use of Hard-coded Credentials
A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due
- 7.8 High severity
Secure Connect Gateway (SCG) Policy Manager: Use of Hard-coded Credentials
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded credentials, could potentially exploit this vulnerability to login to the system to gain admin privileges
- 9.8 Critical severity
Secure Connect Gateway (SCG) Policy Manager: Use of Hard-coded Credentials
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the sys
- 9.8 Critical severity
RTLS Studio: Use of Hard-coded Credentials
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access.
- 9.8 Critical severity
izanami: Use of Hard-coded Credentials
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the auth
- 9.8 Critical severity
Secure Connect Gateway (SCG) Policy Manager: Use of Hard-coded Credentials
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the sys
- 9.8 Critical severity
Secure Connect Gateway (SCG) Policy Manager: Use of Hard-coded Credentials
Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of the hard-coded sensitive information, could potentially exploit this vulnerability to login to the sys
- 7.8 High severity
Zoom Rooms for macOS: Use of Hard-coded Credentials
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local lo
- 9.8 Critical severity
FOXMAN-UN: Use of Hard-coded Credentials
The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trust