CWE-259 · Use of Hard-coded Password (page 2)
Page 2 of 2 — CVEs classified under CWE-259, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-7332 | Critical | 9.8 | 2024-08-01 | A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-b… |
CVE-2024-7216 | Low | 2.6 | 2024-07-30 | A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample… |
CVE-2024-7170 | Low | 3.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi… |
CVE-2024-7159 | Medium | 5.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web… |
CVE-2024-7155 | Low | 2.5 | 2024-07-28 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-39345 | High | 7.2 | 2024-07-24 | AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support account whose passw… |
CVE-2024-36526 | Critical | 9.8 | 2024-07-09 | ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. |
CVE-2023-46685 | Critical | 9.8 | 2024-07-08 | A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted netwo… |
CVE-2024-4708 | Critical | 9.8 | 2024-07-02 | mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. |
CVE-2024-38902 | Critical | 9.8 | 2024-06-24 | H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-5275 | High | 7.8 | 2024-06-18 | A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example… |
CVE-2024-37644 | High | 8.8 | 2024-06-14 | TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. |
CVE-2024-34539 | Critical | 9.4 | 2024-06-14 | Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials ca… |
CVE-2024-27164 | High | 7.1 | 2024-06-14 | Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL. |
CVE-2024-28023 | Medium | 5.7 | 2024-06-11 | A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possi… |
CVE-2024-3700 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all S… |
CVE-2024-3699 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all d… |
CVE-2024-1228 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all E… |
CVE-2024-2420 | Critical | 9.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows… |
CVE-2024-35395 | High | 8.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as… |
CVE-2024-2038 | High | 7.5 | 2024-05-23 | The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and i… |
CVE-2024-34025 | Critical | 9.8 | 2024-05-15 | CyberPower PowerPanel business application code contains a hard-coded set of authentication credentials. This could result in an attacker bypassing authentica… |
CVE-2024-33625 | Critical | 9.8 | 2024-05-15 | CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokens to bypass authenti… |
CVE-2024-33867 | Medium | 4.8 | 2024-05-14 | An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt. |
CVE-2024-32741 | Critical | 10.0 | 2024-05-14 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is used for the privileged… |
CVE-2024-34211 | High | 8.8 | 2024-05-14 | TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as r… |
CVE-2024-31810 | Critical | 9.8 | 2024-05-14 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2023-51629 | High | 8.8 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on a… |
CVE-2023-32145 | High | 8.8 | 2024-05-03 | D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on aff… |
CVE-2024-29011 | High | 7.5 | 2024-05-01 | Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlier versions. |
CVE-2024-32210 | Medium | 5.3 | 2024-05-01 | The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL connections. |
CVE-2023-49963 | High | 8.8 | 2024-04-19 | DYMO LabelWriter Print Server through 2.366 contains a backdoor hard-coded password that could allow an attacker to take control. |
CVE-2024-21990 | Medium | 5.4 | 2024-04-17 | ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deplo… |
CVE-2024-28066 | High | 8.8 | 2024-04-08 | In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). |
CVE-2024-27488 | Critical | 9.8 | 2024-04-08 | Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information… |
CVE-2024-28010 | Critical | 9.8 | 2024-03-28 | Use of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200… |
CVE-2024-26196 | Medium | 4.3 | 2024-03-21 | Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability |
CVE-2024-2197 | Medium | 4.3 | 2024-03-20 | The Chirp Access app contains a hard-coded password, BEACON_PASSWORD. An attacker within Bluetooth range could change configuration settings within the Bluetoo… |
CVE-2024-27774 | High | 7.5 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside D… |
CVE-2023-50948 | Medium | 6.5 | 2024-01-08 | IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2023-28895 | Low | 3.5 | 2023-12-01 | The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows… |
CVE-2023-41713 | High | 7.5 | 2023-10-17 | SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. |
CVE-2023-5222 | Medium | 6.3 | 2023-09-27 | A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-… |
CVE-2023-41030 | Medium | 6.3 | 2023-09-18 | Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as t… |
CVE-2023-23771 | High | 8.4 | 2023-08-29 | Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to di… |
CVE-2023-23770 | Critical | 9.4 | 2023-08-29 | Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technic… |
CVE-2023-3237 | Medium | 6.3 | 2023-06-14 | A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/passwo… |
CVE-2023-2061 | Medium | 6.2 | 2023-06-02 | Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Ser… |
CVE-2023-1944 | High | 8.4 | 2023-05-24 | This vulnerability enables ssh access to minikube container using a default password. |
CVE-2023-2799 | Medium | 6.3 | 2023-05-18 | A vulnerability, which was classified as problematic, has been found in cnoa OA up to 5.1.1.5. Affected by this issue is some unknown functionality of the file… |
CVE-2023-2645 | Critical | 9.8 | 2023-05-11 | A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The… |
CVE-2023-29103 | Medium | 4.3 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versions < V2.1), SIMATI… |
CVE-2023-0808 | Low | 3.9 | 2023-02-13 | A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unkn… |
CVE-2022-45444 | Critical | 10.0 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the applicati… |
CVE-2018-25069 | High | 7.3 | 2023-01-07 | A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded passwo… |
CVE-2014-125030 | Medium | 6.3 | 2023-01-01 | A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation… |
CVE-2022-41653 | Critical | 9.8 | 2022-12-13 | Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system. |
CVE-2022-29831 | High | 7.5 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker t… |
CVE-2022-29825 | Medium | 5.6 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C… |
CVE-2022-22144 | Critical | 9.8 | 2022-08-05 | A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During sys… |
CVE-2022-30271 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate… |
CVE-2017-20039 | Critical | 9.8 | 2022-06-11 | A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been classified as very critical. This affects an unknown part. The manipulation leads… |
CVE-2022-27172 | High | 8.8 | 2022-05-12 | A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request c… |
CVE-2021-34601 | Critical | 9.8 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone… |
CVE-2021-36312 | Critical | 9.1 | 2021-11-23 | Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-co… |
CVE-2021-38456 | Critical | 9.8 | 2021-10-12 | A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through ac… |
CVE-2021-28813 | Critical | 9.6 | 2021-09-10 | A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If explo… |
CVE-2020-5351 | High | 7.5 | 2021-07-28 | Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded passwor… |
CVE-2021-22729 | Critical | 9.8 | 2021-07-21 | A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2… |
CVE-2021-21818 | High | 7.5 | 2021-07-16 | A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can le… |
CVE-2021-32525 | Critical | 9.1 | 2021-07-07 | The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credent… |
CVE-2021-32521 | High | 7.3 | 2021-07-07 | Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSA… |
CVE-2019-10881 | Critical | 9.8 | 2021-04-13 | Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with… |
CVE-2021-27452 | High | 7.8 | 2021-03-25 | The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (… |
CVE-2021-27440 | Critical | 9.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2021-27254 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exp… |
CVE-2020-2499 | Medium | 6.3 | 2020-12-24 | A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with… |
CVE-2020-7590 | Medium | 6.8 | 2020-10-13 | A vulnerability has been identified in DCA Vantage Analyzer (All versions < V4.5 are affected by CVE-2020-7590. In addition, serial numbers < 40000 running sof… |
CVE-2020-12047 | Critical | 9.8 | 2020-06-29 | The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless config… |
CVE-2020-12045 | Critical | 9.8 | 2020-06-29 | The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), operates a Telnet ser… |
CVE-2020-12039 | Low | 2.4 | 2020-06-29 | Baxter Sigma Spectrum Infusion Pumps Sigma Spectrum Infusion System v's6.x model 35700BAX & Baxter Spectrum Infusion System v's8.x model 35700BAX2 contain hard… |
CVE-2020-12037 | High | 7.5 | 2020-06-29 | Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TLS/SSL) when config… |
CVE-2020-12016 | Critical | 9.8 | 2020-06-29 | Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix E… |
CVE-2020-12012 | Medium | 6.1 | 2020-06-29 | Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix E… |
CVE-2019-13530 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2014-5431 | Medium | 6.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provide… |
CVE-2014-5434 | Critical | 9.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credent… |
CVE-2015-3953 | Critical | 9.8 | 2019-03-25 | Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2019-3908 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access… |
CVE-2018-8870 | Medium | 6.4 | 2018-07-03 | Medtronic 24950 MyCareLink Monitor and 24952 MyCareLink Monitor contains a hard-coded operating system password. An attacker with physical access can remove th… |
CVE-2017-6022 | Critical | 9.8 | 2017-06-30 | A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Versio… |
CVE-2016-9358 | Critical | 9.8 | 2017-06-30 | A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Maste… |
CVE-2017-6039 | Medium | 5.3 | 2017-06-02 | A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow… |
CVE-2014-5405 | | 2015-04-03 | Hospira MedNet before 6.1 uses a hardcoded cleartext password to control SQL database authorization, which allows remote authenticated users to bypass intended… | |
CVE-2014-2363 | | 2014-07-26 | Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request. | |
CVE-2012-5862 | | 2012-11-23 | These Sinapsi devices store hard-coded passwords in the PHP file of the device. By using the hard-coded passwords in the device, attackers can log into the de… |