CWE-798 · Use of Hard-coded Credentials (page 10)
Page 10 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34840 | Medium | 6.5 | 2022-12-07 | Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the devic… |
CVE-2022-38337 | Critical | 9.1 | 2022-12-06 | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can… |
CVE-2022-40259 | High | 8.3 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-40242 | High | 7.5 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-44097 | Critical | 9.8 | 2022-11-30 | Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-44096 | Critical | 9.8 | 2022-11-30 | Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-32967 | Low | 2.1 | 2022-11-29 | RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reb… |
CVE-2022-41157 | High | 8.1 | 2022-11-25 | A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to lea… |
CVE-2022-29831 | High | 7.5 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker t… |
CVE-2022-29830 | Critical | 9.1 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related… |
CVE-2022-29829 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fro… |
CVE-2022-29828 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29827 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29825 | Medium | 5.6 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C… |
CVE-2022-40602 | Critical | 9.8 | 2022-11-22 | A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured… |
CVE-2021-34577 | Medium | 6.5 | 2022-11-09 | In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the de… |
CVE-2022-37710 | High | 7.8 | 2022-11-07 | Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft… |
CVE-2022-40263 | Medium | 6.6 | 2022-11-04 | BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensit… |
CVE-2022-20868 | Medium | 4.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance coul… |
CVE-2022-26119 | High | 7.8 | 2022-11-02 | A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish serve… |
CVE-2022-29889 | Critical | 9.8 | 2022-10-25 | A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root passw… |
CVE-2022-29477 | Critical | 9.8 | 2022-10-25 | An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and… |
CVE-2022-38117 | Medium | 5.5 | 2022-10-24 | Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciph… |
CVE-2021-4228 | Medium | 5.8 | 2022-10-24 | Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This… |
CVE-2022-42176 | High | 7.8 | 2022-10-20 | In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access. |
CVE-2022-41540 | Medium | 5.9 | 2022-10-18 | The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the c… |
CVE-2022-42980 | Critical | 9.8 | 2022-10-17 | go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key. |
CVE-2022-38420 | High | 7.5 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in… |
CVE-2022-34425 | High | 7.5 | 2022-10-10 | Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vul… |
CVE-2022-39273 | Medium | 4.8 | 2022-10-06 | FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default… |
CVE-2022-20844 | Medium | 5.3 | 2022-09-30 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2020-15327 | High | 7.5 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication. |
CVE-2020-15326 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem. |
CVE-2022-28812 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentia… |
CVE-2022-22522 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentia… |
CVE-2022-36159 | High | 8.8 | 2022-09-26 | Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password stren… |
CVE-2022-3214 | Critical | 9.8 | 2022-09-16 | Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to 1… |
CVE-2022-38823 | Critical | 9.8 | 2022-09-16 | In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. |
CVE-2022-35582 | High | 8.8 | 2022-09-13 | Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating system that WAPPLES runs on has a built-i… |
CVE-2022-35413 | Critical | 9.8 | 2022-09-13 | WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (suc… |
CVE-2022-31322 | High | 7.8 | 2022-09-13 | Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged executables. |
CVE-2022-38069 | Medium | 4.3 | 2022-09-13 | Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileg… |
CVE-2022-37857 | High | 7.5 | 2022-09-08 | bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-s… |
CVE-2022-38394 | Critical | 9.8 | 2022-09-08 | Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to exe… |
CVE-2022-40111 | Critical | 9.8 | 2022-09-06 | In TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 in the shadow.sample file, root is hardcoded in the firmware. |
CVE-2022-37841 | High | 7.5 | 2022-09-06 | In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample. |
CVE-2022-36672 | Critical | 9.8 | 2022-09-01 | Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom use… |
CVE-2022-30318 | Critical | 9.8 | 2022-08-31 | Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. Th… |
CVE-2022-38116 | Critical | 9.8 | 2022-08-30 | Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker c… |
CVE-2022-36560 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /et… |
CVE-2022-36558 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /et… |
CVE-2022-36616 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36615 | High | 7.8 | 2022-08-29 | TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36614 | High | 7.8 | 2022-08-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36613 | High | 7.8 | 2022-08-29 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36612 | High | 7.8 | 2022-08-29 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36611 | High | 7.8 | 2022-08-29 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36610 | High | 7.8 | 2022-08-29 | TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-31269 | High | 8.2 | 2022-08-25 | Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in… |
CVE-2022-30036 | High | 8.8 | 2022-08-21 | MA Lighting grandMA2 Light has a password of root for the root account. NOTE: The vendor's position is that the product was designed for isolated networks. Als… |
CVE-2022-36171 | High | 8.1 | 2022-08-19 | MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion. |
CVE-2022-36170 | High | 8.8 | 2022-08-19 | MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. |
CVE-2022-35540 | Critical | 9.8 | 2022-08-18 | Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access. |
CVE-2022-1400 | High | 7.1 | 2022-08-17 | Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an… |
CVE-2022-35734 | High | 7.5 | 2022-08-16 | 'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerabi… |
CVE-2021-44720 | High | 7.2 | 2022-08-12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Config… |
CVE-2022-35491 | Critical | 9.8 | 2022-08-10 | TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample. |
CVE-2022-22144 | Critical | 9.8 | 2022-08-05 | A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During sys… |
CVE-2022-34993 | Critical | 9.8 | 2022-08-04 | Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample. |
CVE-2022-32965 | Critical | 9.8 | 2022-08-04 | OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitr… |
CVE-2022-35866 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not… |
CVE-2022-30314 | Medium | 4.6 | 2022-07-28 | Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded… |
CVE-2021-22644 | High | 7.5 | 2022-07-28 | Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. |
CVE-2022-36952 | High | 8.4 | 2022-07-27 | In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9… |
CVE-2022-30274 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. C… |
CVE-2022-30271 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate… |
CVE-2022-29964 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root… |
CVE-2022-29963 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a roo… |
CVE-2022-29962 | Medium | 5.5 | 2022-07-26 | The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often… |
CVE-2022-29960 | Medium | 5.5 | 2022-07-26 | Emerson OpenBSI through 2022-04-29 uses weak cryptography. It is an engineering environment for the ControlWave and Bristol Babcock line of RTUs. DES with hard… |
CVE-2022-29953 | Critical | 9.8 | 2022-07-26 | The Bently Nevada 3700 series of condition monitoring equipment through 2022-04-29 has a maintenance interface on port 4001/TCP with undocumented, hardcoded cr… |
CVE-2022-34907 | Critical | 9.8 | 2022-07-25 | An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain acc… |
CVE-2022-34906 | High | 7.5 | 2022-07-25 | A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensiti… |
CVE-2022-35287 | High | 7.5 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authen… |
CVE-2022-26138 | Critical | 9.8 | 2022-07-20 | The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the usern… |
CVE-2022-34045 | Critical | 9.8 | 2022-07-20 | Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bi… |
CVE-2022-2107 | Critical | 9.8 | 2022-07-20 | The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to… |
CVE-2022-24657 | Critical | 9.8 | 2022-07-20 | Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22). |
CVE-2022-29060 | High | 8.1 | 2022-07-19 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may… |
CVE-2022-30627 | Medium | 5.7 | 2022-07-18 | This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_… |
CVE-2022-32985 | Critical | 9.8 | 2022-07-17 | libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201. |
CVE-2022-31210 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web applic… |
CVE-2022-30622 | Medium | 5.3 | 2022-07-17 | Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path acces… |
CVE-2022-32389 | High | 7.5 | 2022-07-14 | Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. This allows attackers to access sensitive information such as user… |
CVE-2022-28371 | High | 7.5 | 2022-07-14 | On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate fo… |
CVE-2022-35857 | Critical | 9.8 | 2022-07-13 | kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted wit… |
CVE-2020-4157 | High | 7.5 | 2022-07-12 | IBM QRadar Network Security 5.4.0 and 5.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authent… |
CVE-2020-4150 | Critical | 9.8 | 2022-07-11 | IBM SiteProtector Appliance 3.1.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2022-34151 | High | 8.1 | 2022-07-04 | Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7… |
CVE-2021-40597 | Critical | 9.8 | 2022-06-29 | The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password. |