CWE-798 · Use of Hard-coded Credentials (page 10)
Page 10 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29964 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root… |
CVE-2022-29963 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a roo… |
CVE-2022-29962 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often… |
CVE-2022-29960 | Medium | 5.5 | 2022-07-26 | Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hard… |
CVE-2022-29953 | Critical | 9.8 | 2022-07-26 | The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded cr… |
CVE-2022-34907 | Critical | 9.8 | 2022-07-25 | An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain acc… |
CVE-2022-34906 | High | 7.5 | 2022-07-25 | A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensiti… |
CVE-2022-35287 | High | 7.5 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authen… |
CVE-2022-26138 | Critical | 9.8 | 2022-07-20 | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the usern… |
CVE-2022-34045 | Critical | 9.8 | 2022-07-20 | Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bi… |
CVE-2022-2107 | Critical | 9.8 | 2022-07-20 | The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to… |
CVE-2022-24657 | Critical | 9.8 | 2022-07-20 | Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22). |
CVE-2022-29060 | High | 8.1 | 2022-07-19 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may… |
CVE-2022-30627 | Medium | 5.7 | 2022-07-18 | This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_… |
CVE-2022-32985 | Critical | 9.8 | 2022-07-17 | libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201. |
CVE-2022-31210 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web applic… |
CVE-2022-30622 | Medium | 5.3 | 2022-07-17 | Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path acces… |
CVE-2022-32389 | High | 7.5 | 2022-07-14 | Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. This allows attackers to access sensitive information such as user… |
CVE-2022-28371 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate fo… |
CVE-2022-35857 | Critical | 9.8 | 2022-07-13 | kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted wit… |
CVE-2020-4157 | High | 7.5 | 2022-07-12 | IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authent… |
CVE-2020-4150 | Critical | 9.8 | 2022-07-11 | IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2022-34151 | High | 8.1 | 2022-07-04 | Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7… |
CVE-2021-40597 | Critical | 9.8 | 2022-06-29 | The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password. |
CVE-2022-30997 | High | 7.2 | 2022-06-28 | Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrat… |
CVE-2022-34005 | Critical | 9.8 | 2022-06-19 | An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for the sa account on t… |
CVE-2022-30422 | Critical | 9.8 | 2022-06-17 | Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code execution via the Viewstate parameter. |
CVE-2021-40903 | Critical | 9.8 | 2022-06-17 | A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flask server. Settings file has a predefine… |
CVE-2020-36547 | Medium | 5.9 | 2022-06-17 | A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded credentials. Attac… |
CVE-2022-31619 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All version… |
CVE-2022-26476 | High | 8.8 | 2022-06-14 | A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS… |
CVE-2022-29525 | Critical | 9.8 | 2022-06-13 | Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privileg… |
CVE-2017-20039 | Critical | 9.8 | 2022-06-11 | A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been classified as very critical. This affects an unknown part. The manipulation leads… |
CVE-2022-25807 | Medium | 5.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has… |
CVE-2022-25806 | High | 8.8 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has d… |
CVE-2022-29778 | High | 8.8 | 2022-06-03 | D-Link DIR-890L 1.20b01 allows attackers to execute arbitrary code due to the hardcoded option Wake-On-Lan for the parameter 'descriptor' at SetVirtualServerSe… |
CVE-2021-42892 | Medium | 4.3 | 2022-06-03 | In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware. |
CVE-2022-30234 | Critical | 9.4 | 2022-06-02 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained. Affected Produ… |
CVE-2022-31462 | Critical | 9.3 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial number) that can be found in Bluetooth br… |
CVE-2022-31460 | High | 7.4 | 2022-06-02 | Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value. |
CVE-2022-29730 | Critical | 9.8 | 2022-06-02 | USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. The credentials cann… |
CVE-2022-28605 | Critical | 9.8 | 2022-06-02 | Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in linkplay antifactory |
CVE-2021-33016 | Critical | 9.8 | 2022-05-26 | An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8… |
CVE-2021-33014 | High | 8.8 | 2022-05-26 | An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running… |
CVE-2013-10002 | Medium | 6.5 | 2022-05-24 | A vulnerability was found in Telecommunication Software SAMwin Contact Center Suite 5.1. It has been rated as critical. Affected by this issue is the function… |
CVE-2022-29186 | Critical | 9.1 | 2022-05-20 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contai… |
CVE-2021-42850 | High | 8.8 | 2022-05-18 | A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unautho… |
CVE-2021-42849 | Medium | 6.8 | 2022-05-18 | A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attack… |
CVE-2022-29645 | Critical | 9.8 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shad… |
CVE-2022-29644 | Critical | 9.8 | 2022-05-18 | TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the compo… |
CVE-2022-1701 | High | 7.5 | 2022-05-13 | SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data. |
CVE-2022-27172 | High | 8.8 | 2022-05-12 | A hard-coded password vulnerability exists in the console infactory functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted network request c… |
CVE-2022-26020 | Medium | 6.5 | 2022-05-12 | An information disclosure vulnerability exists in the router configuration export functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted netw… |
CVE-2021-38969 | Critical | 9.8 | 2022-05-11 | IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force I… |
CVE-2022-23724 | Medium | 6.4 | 2022-05-04 | Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an… |
CVE-2022-29856 | High | 7.5 | 2022-04-29 | A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages. |
CVE-2021-34601 | Critical | 9.8 | 2022-04-27 | In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone… |
CVE-2022-23942 | High | 7.5 | 2022-04-26 | Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure. |
CVE-2021-45841 | High | 8.1 | 2022-04-25 | In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address and the user's passw… |
CVE-2022-26672 | High | 7.3 | 2022-04-22 | ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the serve… |
CVE-2022-20773 | High | 7.5 | 2022-04-21 | A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated, remote attacker to imper… |
CVE-2022-24860 | High | 7.4 | 2022-04-20 | Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key vulnerability. An a… |
CVE-2022-28810 | Medium | 6.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the… |
CVE-2020-25168 | Low | 3.3 | 2022-04-14 | Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enable attackers… |
CVE-2021-40422 | Critical | 10.0 | 2022-04-14 | An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network re… |
CVE-2021-40390 | Critical | 9.8 | 2022-04-14 | An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A specially-crafted HTTP request can lead to un… |
CVE-2022-27506 | Low | 2.7 | 2022-04-13 | Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI |
CVE-2022-22560 | High | 7.1 | 2022-04-12 | Dell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login as the admin user t… |
CVE-2022-26671 | High | 7.3 | 2022-04-07 | Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can use the hard-coded… |
CVE-2022-23440 | High | 7.8 | 2022-04-06 | A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allo… |
CVE-2022-23441 | Critical | 9.1 | 2022-04-06 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the netw… |
CVE-2022-1162 | Critical | 9.1 | 2022-04-04 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 pr… |
CVE-2022-25569 | Critical | 9.8 | 2022-04-04 | Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users v… |
CVE-2021-30064 | Critical | 9.8 | 2022-04-03 | On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can su… |
CVE-2021-46008 | High | 8.8 | 2022-03-30 | In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, c… |
CVE-2022-24693 | Critical | 9.8 | 2022-03-30 | Baicells Nova436Q and Neutrino 430 devices with firmware through QRTB 2.7.8 have hardcoded credentials that are easily discovered, and can be used by remote at… |
CVE-2022-25521 | Critical | 9.8 | 2022-03-29 | NUUO v03.11.00 was discovered to contain access control issue. |
CVE-2022-25577 | Critical | 9.1 | 2022-03-25 | ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain… |
CVE-2021-27430 | High | 8.4 | 2022-03-23 | GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with physical access to the UR IED can interrup… |
CVE-2021-45877 | Critical | 9.8 | 2022-03-21 | Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by hard coded credentials. A hardcoded credential exist in /etc/tomcat8/tomcat-user.xml, which allow… |
CVE-2020-25193 | Medium | 5.3 | 2022-03-18 | By having access to the hard-coded cryptographic key for GE Reason RT430, RT431 & RT434 GNSS clocks in firmware versions prior to version 08A06, attackers woul… |
CVE-2020-25180 | Medium | 5.3 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The… |
CVE-2022-26660 | High | 7.5 | 2022-03-16 | RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the credentials that were… |
CVE-2022-25246 | Critical | 9.8 | 2022-03-16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitati… |
CVE-2021-41848 | High | 7.8 | 2022-03-11 | An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It mishandles software updates such that local third-party apps can provide a spoofed softwa… |
CVE-2022-23402 | Critical | 9.8 | 2022-03-11 | The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6… |
CVE-2022-21194 | Critical | 9.8 | 2022-03-11 | The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R… |
CVE-2022-25510 | High | 8.8 | 2022-03-11 | FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges. |
CVE-2022-25217 | High | 7.8 | 2022-03-10 | Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device ove… |
CVE-2022-25213 | Medium | 6.8 | 2022-03-10 | Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprot… |
CVE-2022-25045 | Critical | 9.8 | 2022-03-02 | Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admi… |
CVE-2022-24255 | High | 8.8 | 2022-03-01 | Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges. |
CVE-2022-25329 | Critical | 9.8 | 2022-02-24 | Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An una… |
CVE-2021-27797 | Critical | 9.8 | 2022-02-21 | Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x contain documented hard-coded credentials, w… |
CVE-2022-23650 | High | 7.2 | 2022-02-18 | Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cry… |
CVE-2021-46247 | High | 7.5 | 2022-02-17 | The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from ASUS CMAX6000 v1.02.00. |
CVE-2022-22765 | High | 8.0 | 2022-02-12 | BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive infor… |
CVE-2022-22766 | High | 7.0 | 2022-02-11 | Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could po… |
CVE-2020-36062 | Critical | 9.8 | 2022-02-11 | Dairy Farm Shop Management System v1.0 was discovered to contain hardcoded credentials in the source code which allows attackers access to the control panel if… |
CVE-2022-22813 | Critical | 9.8 | 2022-02-09 | A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier t… |