Use of Hard-coded Credentials
CWE-798
The product contains hard-coded credentials, such as a password or cryptographic key.
We track 711 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 12 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible. In Windows environments, the Encrypted File System (EFS) may provide some protection.
- Architecture and Design: For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a first login mode that requires the user to enter a unique strong password or key.
- Architecture and Design: If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Latest Use of Hard-coded Credentials vulnerabilities
- 8.1 High severity
PingID Integration for Windows Login: Use of Hard-coded Credentials
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user crede
- 9.8 Critical severity
WebStorage: Use of Hard-coded Credentials
ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user account
- 7.5 High severity
Cisco Umbrella Insights Virtual Appliance: Use of Hard-coded Credentials
A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could ex
- 9.8 Critical severity
databasir: Use of Hard-coded Credentials
Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An attacker can use hard coding to generate login credentials of any user and log in to the service backg
- 6.8 Medium severity
Zoho ManageEngine ADSelfService Plus Remote Code Execution Exploited
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be a
- 7.3 High severity
Personnel Attendance Management system: Use of Hard-coded Credentials
Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded credential to acquire partial system information and modify system setting to cause partial disrupt
- 7.8 High severity
Fortinet FortiEDR: Use of Hard-coded Credentials
A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deploy
- 9.1 Critical severity
Fortinet FortiEDR: Use of Hard-coded Credentials
A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the network to disguise as and forge messages from other collectors.
- 9.8 Critical severity
GitLab: Use of Hard-coded Credentials
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts
- 9.8 Critical severity
Sgsetup: Use of Hard-coded Credentials
Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software.
- 9.8 Critical severity
Nova436q Firmware: Use of Hard-coded Credentials
Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmware, encrypted by the crypt
- 9.1 Critical severity
Alf-banco: Use of Hard-coded Credentials
ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.
- 7.5 High severity
Runasspc: Use of Hard-coded Credentials
RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were used.
- 8.8 High severity
Axeda agent: Use of Hard-coded Credentials
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of t
- 9.8 Critical severity
CENTUM VP: Use of Hard-coded Credentials
The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00
- 9.8 Critical severity
CENTUM VP: Use of Hard-coded Credentials
The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.0, Exaopc versions from R3.72.00 to R3.79.00.
- 8.8 High severity
Freetakserver-ui: Use of Hard-coded Credentials
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
- 7.8 High severity
Phicomm Routers: Use of Hard-coded Credentials
Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetd_startup included in the version 22.5.9.163 of the K2 firmware, and ve
- 9.8 Critical severity
Home Owners Collection Management System: Use of Hard-coded Credentials
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
- 9.8 Critical severity
Trend Micro ServerProtect for Storage: Use of Hard-coded Credentials
Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to
- 8.8 High severity
netmaker: Use of Hard-coded Credentials
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if th
- 7.8 High severity
BD Viper LT System: Use of Hard-coded Credentials
BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI)
- 9.8 Critical severity
Easergy P40 Series model numbers with Ethernet…: Use of Hard-coded Credentials
A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with
- 9.8 Critical severity
ADAM-3600: Use of Hard-coded Credentials
The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.
- 7.5 High severity
Easergy P5: Use of Hard-coded Credentials
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product
- 9.8 Critical severity
Dental Management System: Use of Hard-coded Credentials
The Le-yan dental management system contains a hard-coded credentials vulnerability in the web page source code, which allows an unauthenticated remote attacker to acquire administrator’s privilege and control the system or disrupt service.
- 7.5 High severity
pudding-bot: Use of Hard-coded Credentials
PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessible to malicious actors. The bot token has been revoked and new version is already running on the server. As of time of pub
- 9.8 Critical severity
Homer Webapp: Use of Hard-coded Credentials
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
- 8.1 High severity
Acclaim Systems USAHERDS Use of Hard-Coded Credentials Exploited
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
- 9.8 Critical severity
EyesOfNetwork Use of Hard-Coded Credentials Exploited
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access t
- 6.5 Medium severity
Fortinet FortiOS Use of Hard-Coded Credentials Exploited
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data incl