CWE-798 · Use of Hard-coded Credentials (page 12)
Page 12 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-32993 | High | 8.1 | 2021-12-27 | IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inboun… |
CVE-2021-45522 | Medium | 6.1 | 2021-12-26 | NETGEAR XR1000 devices before 1.0.0.58 are affected by a hardcoded password. |
CVE-2021-45521 | High | 7.4 | 2021-12-26 | Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10. |
CVE-2021-45520 | Critical | 9.6 | 2021-12-26 | Certain NETGEAR devices are affected by a hardcoded password. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10. |
CVE-2021-44207 | High | 8.1 | 2021-12-21 | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. |
CVE-2021-41028 | High | 8.2 | 2021-12-16 | A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate v… |
CVE-2021-26108 | High | 7.5 | 2021-12-08 | A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. |
CVE-2021-43044 | Critical | 9.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community. |
CVE-2021-43284 | High | 7.8 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its default value of admin. This enables an atta… |
CVE-2021-43282 | Medium | 6.5 | 2021-11-30 | An issue was discovered on Victure WR1200 devices through 1.0.3. The default Wi-Fi WPA2 key is advertised to anyone within Wi-Fi range through the router's MAC… |
CVE-2021-26611 | High | 8.1 | 2021-11-26 | HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory rese… |
CVE-2021-40519 | Critical | 10.0 | 2021-11-10 | Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials. |
CVE-2021-43136 | Critical | 9.8 | 2021-11-10 | An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform. |
CVE-2021-43575 | Medium | 5.5 | 2021-11-09 | KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a simil… |
CVE-2021-40119 | Critical | 9.8 | 2021-11-04 | A vulnerability in the key-based SSH authentication mechanism of Cisco Policy Suite could allow an unauthenticated, remote attacker to log in to an affected sy… |
CVE-2021-38461 | High | 8.2 | 2021-10-22 | The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted from binaries. |
CVE-2021-41320 | Medium | 5.5 | 2021-10-15 | A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the… |
CVE-2021-38456 | Critical | 9.8 | 2021-10-12 | A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through ac… |
CVE-2021-34757 | Medium | 4.9 | 2021-10-06 | Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login c… |
CVE-2021-34744 | Medium | 4.9 | 2021-10-06 | Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login c… |
CVE-2021-33583 | Critical | 9.8 | 2021-09-30 | REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file. |
CVE-2021-41299 | Critical | 9.8 | 2021-09-30 | ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers can obtain administrator’s privilege wit… |
CVE-2021-41828 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. |
CVE-2021-41827 | High | 7.5 | 2021-09-30 | Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials are in the source code that corresponds… |
CVE-2020-4690 | Critical | 9.8 | 2021-09-23 | IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-21913 | Critical | 9.8 | 2021-09-23 | An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specially-crafted network request can lead to… |
CVE-2021-34571 | Medium | 6.5 | 2021-09-16 | Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An adversary can learn a… |
CVE-2021-28813 | Critical | 9.6 | 2021-09-10 | A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running QuNetSwitch. If explo… |
CVE-2021-28912 | High | 7.2 | 2021-09-09 | BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own unique hard coded and weak root SSH key passphrase known as 'eibPort string'. This is usable and the f… |
CVE-2021-33484 | High | 7.5 | 2021-09-07 | An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a h… |
CVE-2021-40494 | Critical | 9.8 | 2021-09-03 | A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system. |
CVE-2021-36234 | Medium | 5.5 | 2021-08-31 | Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors. |
CVE-2021-34565 | Critical | 9.8 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials. |
CVE-2021-29728 | Medium | 4.9 | 2021-08-30 | IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2021-39615 | Critical | 9.8 | 2021-08-23 | D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeeds in recovering the… |
CVE-2021-39614 | Critical | 9.8 | 2021-08-23 | D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As weak passwords have been used, the plaintext pas… |
CVE-2021-39613 | Critical | 9.8 | 2021-08-23 | D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. As wea… |
CVE-2021-39245 | High | 7.5 | 2021-08-23 | Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices. This affects Nexto NX3003 1.8.11.0, Nexto NX3004… |
CVE-2021-32588 | Critical | 9.8 | 2021-08-18 | A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may… |
CVE-2020-25565 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the acces… |
CVE-2020-25561 | High | 7.8 | 2021-08-11 | SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client. |
CVE-2020-25560 | Critical | 9.8 | 2021-08-11 | In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the acces… |
CVE-2013-6276 | Critical | 9.8 | 2021-08-09 | QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files. NOTE: 1. All active models are not affected. The last affected model wa… |
CVE-2021-27952 | Critical | 9.8 | 2021-08-03 | Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader… |
CVE-2021-27503 | Medium | 4.8 | 2021-08-02 | Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The applica… |
CVE-2021-37163 | Critical | 9.8 | 2021-08-02 | An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software before Nexus Software… |
CVE-2021-37555 | Critical | 9.8 | 2021-07-26 | TX9 Automatic Food Dispenser v3.2.57 devices allow access to a shell as root/superuser, a related issue to CVE-2019-16734. To connect, the telnet service is us… |
CVE-2021-31579 | High | 8.2 | 2021-07-22 | Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA applian… |
CVE-2021-22730 | Critical | 9.8 | 2021-07-21 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / E… |
CVE-2021-22707 | Critical | 9.8 | 2021-07-21 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / E… |
CVE-2020-5349 | Critical | 9.8 | 2021-07-19 | Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability. A remote unauthenticated… |
CVE-2021-36799 | High | 8.8 | 2021-07-19 | KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information. NOTE: T… |
CVE-2021-35961 | Critical | 9.8 | 2021-07-16 | Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attackers to access the s… |
CVE-2021-21820 | Critical | 9.8 | 2021-07-16 | A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lea… |
CVE-2021-21818 | High | 7.5 | 2021-07-16 | A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can le… |
CVE-2021-0279 | High | 8.6 | 2021-07-15 | Juniper Networks Contrail Cloud (CC) releases prior to 13.6.0 have RabbitMQ service enabled by default with hardcoded credentials. The messaging services of Ra… |
CVE-2021-20537 | Medium | 6.5 | 2021-07-15 | IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentica… |
CVE-2021-34688 | Low | 3.3 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read an encrypted version of the system's Personal… |
CVE-2021-20748 | High | 7.5 | 2021-07-14 | Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external service. By exploiting… |
CVE-2021-1576 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-1574 | High | 8.8 | 2021-07-08 | Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elev… |
CVE-2021-33220 | High | 7.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist. |
CVE-2021-33219 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and… |
CVE-2021-33218 | Critical | 9.8 | 2021-07-07 | An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access. |
CVE-2021-32535 | Critical | 9.8 | 2021-07-07 | The vulnerability of hard-coded default credentials in QSAN SANOS allows unauthenticated remote attackers to obtain administrator’s permission and execute arbi… |
CVE-2021-32525 | Critical | 9.1 | 2021-07-07 | The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credent… |
CVE-2021-32521 | High | 7.3 | 2021-07-07 | Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSA… |
CVE-2021-32520 | Critical | 9.8 | 2021-07-07 | Use of hard-coded cryptographic key vulnerability in QSAN Storage Manager allows attackers to obtain users’ credentials and related permissions. Suggest contac… |
CVE-2021-24005 | Medium | 4.0 | 2021-07-06 | Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with acc… |
CVE-2021-31505 | Medium | 6.8 | 2021-06-29 | This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278. Authentication is not req… |
CVE-2021-33540 | High | 7.3 | 2021-06-25 | In certain devices of the Phoenix Contact AXL F BK and IL BK product families an undocumented password protected FTP access to the root directory exists. |
CVE-2021-33531 | High | 8.8 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions an exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities. The d… |
CVE-2021-33529 | High | 7.5 | 2021-06-25 | In Weidmueller Industrial WLAN devices in multiple versions the usage of hard-coded cryptographic keys within the service agent binary allows for the decryptio… |
CVE-2021-34812 | Medium | 5.8 | 2021-06-18 | Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via… |
CVE-2021-31477 | High | 7.3 | 2021-06-16 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exp… |
CVE-2020-25752 | Medium | 5.3 | 2021-06-16 | An issue was discovered on Enphase Envoy R3.x and D4.x devices. There are hardcoded web-panel login passwords for the installer and Enphase accounts. The passw… |
CVE-2021-27481 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allo… |
CVE-2020-15382 | High | 7.2 | 2021-06-09 | Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at i… |
CVE-2020-29323 | High | 7.5 | 2021-06-04 | The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an un… |
CVE-2020-29322 | High | 7.5 | 2021-06-04 | The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2020-29321 | High | 7.5 | 2021-06-04 | The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2021-3565 | Medium | 5.9 | 2021-06-04 | A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM a… |
CVE-2020-1716 | High | 8.8 | 2021-05-28 | A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. A… |
CVE-2021-32459 | Medium | 6.5 | 2021-05-27 | Trend Micro Home Network Security version 6.6.604 and earlier contains a hard-coded password vulnerability in the log collection server which could allow an at… |
CVE-2021-20426 | Critical | 9.8 | 2021-05-24 | IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-29691 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2021-28111 | High | 8.8 | 2021-05-20 | Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker. |
CVE-2021-32454 | Critical | 9.6 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the admi… |
CVE-2021-20025 | High | 7.8 | 2021-05-13 | SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An atta… |
CVE-2021-27437 | Critical | 9.1 | 2021-05-07 | The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and… |
CVE-2021-20401 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2020-4932 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2020-21995 | Critical | 9.8 | 2021-04-29 | Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the s… |
CVE-2021-30165 | High | 7.5 | 2021-04-27 | The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privi… |
CVE-2021-25898 | High | 7.5 | 2021-04-23 | An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when acc… |
CVE-2021-27392 | High | 8.8 | 2021-04-22 | A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open… |
CVE-2021-0266 | High | 8.1 | 2021-04-22 | The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a… |
CVE-2021-0248 | Critical | 10.0 | 2021-04-22 | This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker t… |
CVE-2021-0245 | High | 7.8 | 2021-04-22 | A Use of Hard-coded Credentials vulnerability in Juniper Networks Junos OS on Junos Fusion satellite devices allows an attacker who is local to the device to e… |
CVE-2019-10881 | Critical | 9.8 | 2021-04-13 | Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with… |