CWE-798 · Use of Hard-coded Credentials (page 13)
Page 13 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14099 | High | 7.5 | 2021-04-08 | On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can… |
CVE-2021-26579 | Medium | 5.5 | 2021-03-30 | A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptograp… |
CVE-2020-35138 | Critical | 9.8 | 2021-03-29 | The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details du… |
CVE-2020-35137 | High | 7.5 | 2021-03-29 | The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demons… |
CVE-2021-27452 | High | 7.8 | 2021-03-25 | The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentials on the MU320E (… |
CVE-2021-27440 | Critical | 9.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2021-27438 | High | 8.8 | 2021-03-25 | The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components on the Reason DR60… |
CVE-2020-13963 | Critical | 9.8 | 2021-03-21 | SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for ad… |
CVE-2020-27278 | Medium | 5.2 | 2021-03-15 | In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical access to obtain admin p… |
CVE-2020-28952 | High | 7.5 | 2021-03-09 | An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchan… |
CVE-2021-27254 | High | 8.8 | 2021-03-05 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exp… |
CVE-2021-21979 | High | 7.3 | 2021-03-03 | In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r… |
CVE-2021-20442 | High | 7.5 | 2021-03-03 | IBM Security Verify Bridge contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… |
CVE-2020-35296 | High | 7.5 | 2021-03-03 | ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access. |
CVE-2019-25021 | High | 7.5 | 2021-02-27 | An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the ad… |
CVE-2021-22667 | Critical | 9.8 | 2021-02-24 | BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access a… |
CVE-2020-7846 | High | 8.0 | 2021-02-24 | Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download an… |
CVE-2021-27228 | Critical | 9.8 | 2021-02-22 | An issue was discovered in Shinobi through ocean version 1. lib/auth.js has Incorrect Access Control. Valid API Keys are held in an internal JS Object. Therefo… |
CVE-2020-9306 | High | 8.8 | 2021-02-18 | Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the… |
CVE-2020-12376 | Medium | 5.5 | 2021-02-17 | Use of hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow authenticated user… |
CVE-2020-35567 | High | 7.8 | 2021-02-16 | An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this passw… |
CVE-2021-20412 | High | 7.5 | 2021-02-12 | IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou… |
CVE-2020-25493 | High | 7.5 | 2021-02-11 | Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payloa… |
CVE-2021-27172 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. A hardcoded GEPON password for root is defined inside /etc/init.d/system-config.sh. |
CVE-2021-27169 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. There is a gepon password for the gepon account. |
CVE-2021-27168 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. There is a 6GFJdY4aAuUKJjdtSn7d password for the rdsadmin account. |
CVE-2021-27167 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. There is a password of four hexadecimal characters for the admin account. These characters… |
CVE-2021-27166 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The password for the enable command is gpon. |
CVE-2021-27165 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The telnet daemon on port 23/tcp can be abused with the gpon/gpon credentials. |
CVE-2021-27164 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / aisadmin credentials for an ISP. |
CVE-2021-27163 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / tele1234 credentials for an ISP. |
CVE-2021-27162 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / tattoo@home credentials for an ISP. |
CVE-2021-27161 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 1234 credentials for an ISP. |
CVE-2021-27160 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / 888888 credentials for an ISP. |
CVE-2021-27159 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded useradmin / 888888 credentials for an ISP. |
CVE-2021-27158 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded L1vt1m4eng / 888888 credentials for an ISP. |
CVE-2021-27157 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 888888 credentials for an ISP. |
CVE-2021-27156 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains credentials for an ISP that equal the last part of the MAC address… |
CVE-2021-27155 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / 3UJUh2VemEfUtesEchEC2d2e credentials for an… |
CVE-2021-27154 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / G0R2U1P2ag credentials for an ISP. |
CVE-2021-27153 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded trueadmin / admintrue credentials for an ISP. |
CVE-2021-27152 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded awnfibre / fibre@dm!n credentials for an ISP. |
CVE-2021-27151 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded rootmet / m3tr0r00t credentials for an ISP. |
CVE-2021-27150 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded gestiontelebucaramanga / t3l3buc4r4m4ng42013 credent… |
CVE-2021-27149 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded adminpldt / z6dUABtl270qRxt7a2uGTiw credentials for… |
CVE-2021-27148 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded telecomadmin / nE7jA%5m credentials for an ISP. |
CVE-2021-27147 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / admin credentials for an ISP. |
CVE-2021-27146 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / CUadmin credentials for an ISP. |
CVE-2021-27145 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded admin / lnadmin credentials for an ISP. |
CVE-2021-27144 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded f~i!b@e#r$h%o^m*esuperadmin / s(f)u_h+g|u credential… |
CVE-2021-27143 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web daemon contains the hardcoded user / user1234 credentials for an ISP. |
CVE-2021-27142 | High | 7.5 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. The web management is done over HTTPS, using a hardcoded private key that has 0777 permiss… |
CVE-2021-27141 | Critical | 9.8 | 2021-02-10 | An issue was discovered on FiberHome HG6245D devices through RP2613. Credentials in /fhconf/umconfig.txt are obfuscated via XOR with the hardcoded *j7a(L#yZ98s… |
CVE-2021-25275 | High | 7.8 | 2021-02-03 | SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores database credentials to a… |
CVE-2019-20471 | High | 7.8 | 2021-02-01 | An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup, a default password is used (123456) fo… |
CVE-2020-15833 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to accept an alternate hard-coded path to… |
CVE-2020-13858 | Critical | 9.8 | 2021-02-01 | An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mo… |
CVE-2020-6779 | Critical | 10.0 | 2021-01-26 | Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remo… |
CVE-2020-28999 | High | 7.2 | 2021-01-26 | An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices. A remote attacker can take full control of the cam… |
CVE-2020-28998 | Critical | 9.8 | 2021-01-26 | An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the Telnet service that allows a remote attacker to take full cont… |
CVE-2020-25173 | High | 7.8 | 2021-01-26 | An attacker with local network access can obtain a fixed cryptography key which may allow for further compromise of Reolink P2P cameras outside of local networ… |
CVE-2021-1219 | High | 7.8 | 2021-01-20 | A vulnerability in Cisco Smart Software Manager Satellite could allow an authenticated, local attacker to access sensitive information on an affected system. T… |
CVE-2020-4983 | High | 7.8 | 2021-01-20 | IBM Spectrum LSF 10.1 and IBM Spectrum LSF Suite 10.2 could allow a user on the local network who has privileges to submit LSF jobs to execute arbitrary comman… |
CVE-2020-27256 | Medium | 6.8 | 2021-01-19 | In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump allows attackers wit… |
CVE-2020-35929 | Critical | 9.8 | 2021-01-19 | In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This inf… |
CVE-2020-28395 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variant… |
CVE-2020-28391 | Medium | 5.9 | 2021-01-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl… |
CVE-2020-10206 | Medium | 4.4 | 2020-12-30 | Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allow… |
CVE-2020-10210 | Critical | 9.8 | 2020-12-29 | Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series, Kami7B… |
CVE-2020-10207 | Critical | 9.8 | 2020-12-29 | Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7… |
CVE-2020-29193 | Medium | 6.8 | 2020-12-28 | Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse order). |
CVE-2020-2499 | Medium | 6.3 | 2020-12-24 | A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with… |
CVE-2020-11719 | High | 7.5 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken encryption with a weak and guessable static… |
CVE-2020-11720 | Critical | 9.8 | 2020-12-23 | An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation, it sets up administrative access by de… |
CVE-2020-8995 | Critical | 9.8 | 2020-12-21 | Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers… |
CVE-2020-6882 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The r… |
CVE-2019-14482 | Critical | 9.8 | 2020-12-16 | AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across differ… |
CVE-2020-25620 | High | 7.8 | 2020-12-16 | An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named support@n-able.com and nablea… |
CVE-2020-0016 | High | 7.8 | 2020-12-14 | In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local escalation of privilege in the kernel with no additional execut… |
CVE-2020-25231 | Medium | 5.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3), LOGO! Soft Comfort (All versions < V8.3). The encryption of pr… |
CVE-2020-25229 | High | 7.5 | 2020-12-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). The implemented encryption for communication with affected dev… |
CVE-2020-35338 | Critical | 9.8 | 2020-12-14 | The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password… |
CVE-2020-29383 | High | 7.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. A hardcoded RSA private key (specific to V1600D4L and V1600D-MINI) is… |
CVE-2020-29382 | High | 7.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. A hardcoded RSA private key (specific… |
CVE-2020-29377 | Critical | 9.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 OLT devices. The string K0LTdi@gnos312$ is compared to the password provided by the the remote attacker. If it… |
CVE-2020-29376 | Critical | 9.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devic… |
CVE-2020-29375 | High | 8.8 | 2020-11-29 | An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devic… |
CVE-2020-29062 | Critical | 9.8 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-29061 | Critical | 9.8 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-29060 | Critical | 9.8 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-29059 | Critical | 9.8 | 2020-11-24 | An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S… |
CVE-2020-28329 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor coul… |
CVE-2020-28334 | Critical | 9.8 | 2020-11-24 | Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent W… |
CVE-2020-25688 | Low | 3.5 | 2020-11-23 | A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the sour… |
CVE-2020-4854 | Critical | 9.8 | 2020-11-23 | IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound aut… |
CVE-2020-26097 | Critical | 9.8 | 2020-11-18 | The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on… |
CVE-2020-26509 | High | 7.5 | 2020-11-16 | Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service. |
CVE-2020-26892 | Critical | 9.8 | 2020-11-06 | The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. |
CVE-2020-5667 | Medium | 5.5 | 2020-11-06 | Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. By exploiting this… |
CVE-2020-27689 | Critical | 9.8 | 2020-11-04 | The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A r… |