CWE-798 · Use of Hard-coded Credentials (page 12)
Page 12 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-27481 | Medium | 5.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. This could allo… |
CVE-2020-15382 | High | 7.2 | 2021-06-09 | Brocade SANnav before version 2.1.1 uses a hard-coded administrator account with the weak password ‘passw0rd’ if a password is not provided for PostgreSQL at i… |
CVE-2020-29323 | High | 7.5 | 2021-06-04 | The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an un… |
CVE-2020-29322 | High | 7.5 | 2021-06-04 | The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2020-29321 | High | 7.5 | 2021-06-04 | The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated att… |
CVE-2021-3565 | Medium | 5.9 | 2021-06-04 | A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key for the inner wrapper, potentially allowing a MITM a… |
CVE-2020-1716 | High | 8.8 | 2021-05-28 | A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. A… |
CVE-2021-32459 | Medium | 6.5 | 2021-05-27 | Trend Micro Home Network Security version 6.6.604 and earlier contains a hard-coded password vulnerability in the log collection server which could allow an at… |
CVE-2021-20426 | Critical | 9.8 | 2021-05-24 | IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2021-29691 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2021-28111 | High | 8.8 | 2021-05-20 | Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker. |
CVE-2021-32454 | Critical | 9.6 | 2021-05-17 | SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could modify these credentials, leaving the admi… |
CVE-2021-20025 | High | 7.8 | 2021-05-13 | SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at initial setup. An atta… |
CVE-2021-27437 | Critical | 9.1 | 2021-05-07 | The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and… |
CVE-2021-20401 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2020-4932 | High | 7.8 | 2021-05-05 | IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outboun… |
CVE-2020-21995 | Critical | 9.8 | 2021-04-29 | Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An attacker could exploit this to gain Telnet, SSH and FTP access to the s… |
CVE-2021-30165 | High | 7.5 | 2021-04-27 | The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privi… |
CVE-2021-25898 | High | 7.5 | 2021-04-23 | An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when acc… |
CVE-2021-27392 | High | 8.8 | 2021-04-22 | A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open… |
CVE-2021-0266 | High | 8.1 | 2021-04-22 | The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a… |
CVE-2021-0248 | Critical | 10.0 | 2021-04-22 | This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker t… |
CVE-2021-0245 | High | 7.8 | 2021-04-22 | A Use of Hard-coded Credentials vulnerability in Juniper Networks Junos OS on Junos Fusion satellite devices allows an attacker who is local to the device to e… |
CVE-2019-10881 | Critical | 9.8 | 2021-04-13 | Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with… |
CVE-2020-14099 | High | 7.5 | 2021-04-08 | On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can… |
CVE-2021-26579 | Medium | 5.5 | 2021-03-30 | A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptograp… |
CVE-2020-35138 | Critical | 9.8 | 2021-03-29 | The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details du… |
CVE-2020-35137 | High | 7.5 | 2021-03-29 | The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demons… |
CVE-2021-27452 | High | 7.8 | 2021-03-25 | The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (… |
CVE-2021-27440 | Critical | 9.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2021-27438 | High | 8.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2020-13963 | Critical | 9.8 | 2021-03-21 | SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for ad… |
CVE-2020-27278 | Medium | 5.2 | 2021-03-15 | In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical access to obtain admin p… |
CVE-2020-28952 | High | 7.5 | 2021-03-09 | An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchan… |
CVE-2021-27254 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exp… |
CVE-2021-21979 | High | 7.3 | 2021-03-03 | In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r… |
CVE-2021-20442 | High | 7.5 | 2021-03-03 | IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2020-35296 | High | 7.5 | 2021-03-03 | ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access. |
CVE-2019-25021 | High | 7.5 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the ad… |
CVE-2021-22667 | Critical | 9.8 | 2021-02-24 | BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access a… |
CVE-2020-7846 | High | 8.0 | 2021-02-24 | Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download an… |
CVE-2021-27228 | Critical | 9.8 | 2021-02-22 | An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefo… |
CVE-2020-9306 | High | 8.8 | 2021-02-18 | Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the… |
CVE-2020-12376 | Medium | 5.5 | 2021-02-17 | Use of hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow authenticated user… |
CVE-2020-35567 | High | 7.8 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this passw… |
CVE-2021-20412 | High | 7.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou… |
CVE-2020-25493 | High | 7.5 | 2021-02-11 | Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payloa… |
CVE-2021-27172 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh. |
CVE-2021-27169 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account. |
CVE-2021-27168 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account. |
CVE-2021-27167 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters… |
CVE-2021-27166 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon. |
CVE-2021-27165 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials. |
CVE-2021-27164 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP. |
CVE-2021-27163 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP. |
CVE-2021-27162 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP. |
CVE-2021-27161 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP. |
CVE-2021-27160 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP. |
CVE-2021-27159 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP. |
CVE-2021-27158 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP. |
CVE-2021-27157 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP. |
CVE-2021-27156 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address… |
CVE-2021-27155 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an… |
CVE-2021-27154 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP. |
CVE-2021-27153 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP. |
CVE-2021-27152 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP. |
CVE-2021-27151 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP. |
CVE-2021-27150 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credent… |
CVE-2021-27149 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for… |
CVE-2021-27148 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP. |
CVE-2021-27147 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP. |
CVE-2021-27146 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP. |
CVE-2021-27145 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP. |
CVE-2021-27144 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credential… |
CVE-2021-27143 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP. |
CVE-2021-27142 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permiss… |
CVE-2021-27141 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98s… |
CVE-2021-25275 | High | 7.8 | 2021-02-03 | SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to a… |
CVE-2019-20471 | High | 7.8 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used (123456) fo… |
CVE-2020-15833 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to… |
CVE-2020-13858 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mo… |
CVE-2020-6779 | Critical | 10.0 | 2021-01-26 | Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remo… |
CVE-2020-28999 | High | 7.2 | 2021-01-26 | An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices. A remote attacker can take full control of the cam… |
CVE-2020-28998 | Critical | 9.8 | 2021-01-26 | An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the Telnet service that allows a remote attacker to take full cont… |
CVE-2020-25173 | High | 7.8 | 2021-01-26 | An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local networ… |
CVE-2021-1219 | High | 7.8 | 2021-01-20 | A vulnerability in Cisco Smart Software Manager Satellite could allow an authenticated, local attacker to access sensitive information on an affected system. T… |
CVE-2020-4983 | High | 7.8 | 2021-01-20 | IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary comman… |
CVE-2020-27256 | Medium | 6.8 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers wit… |
CVE-2020-35929 | Critical | 9.8 | 2021-01-19 | In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This inf… |
CVE-2020-28395 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variant… |
CVE-2020-28391 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-10206 | Medium | 4.4 | 2020-12-30 | Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allow… |
CVE-2020-10210 | Critical | 9.8 | 2020-12-29 | Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B… |
CVE-2020-10207 | Critical | 9.8 | 2020-12-29 | Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7… |
CVE-2020-29193 | Medium | 6.8 | 2020-12-28 | Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse order). |
CVE-2020-2499 | Medium | 6.3 | 2020-12-24 | A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with… |
CVE-2020-11719 | High | 7.5 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken encryption with a weak and guessable static… |
CVE-2020-11720 | Critical | 9.8 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation, it sets up administrative access by de… |
CVE-2020-8995 | Critical | 9.8 | 2020-12-21 | Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers… |
CVE-2020-6882 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The r… |