CWE-798 · Use of Hard-coded Credentials (page 15)
Page 15 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-13657 | Critical | 9.8 | 2019-10-17 | CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute… |
CVE-2019-9533 | Critical | 9.8 | 2019-10-10 | The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This could allow an attacker to reverse-engine… |
CVE-2019-15017 | High | 8.4 | 2019-10-09 | The SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to the local network. When combined with PAN-SA-2019-0027, this ca… |
CVE-2019-15015 | High | 8.4 | 2019-10-09 | In the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and inspector user accounts are present in the system software, which can… |
CVE-2019-13658 | Critical | 9.8 | 2019-10-02 | CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise s… |
CVE-2019-13466 | High | 7.5 | 2019-09-30 | Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protecte… |
CVE-2019-10990 | Medium | 6.5 | 2019-09-23 | Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and… |
CVE-2019-16399 | Critical | 9.8 | 2019-09-18 | Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without creden… |
CVE-2019-13474 | Critical | 9.8 | 2019-09-16 | TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial… |
CVE-2019-16313 | High | 7.5 | 2019-09-14 | ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code. |
CVE-2019-13530 | High | 7.2 | 2019-09-12 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Fi… |
CVE-2019-11898 | Critical | 9.9 | 2019-09-12 | Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Acc… |
CVE-2019-13473 | Critical | 9.8 | 2019-09-11 | TELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial i200, Imperial i200-cd, Imperial i400, Imperial i450, Imperial… |
CVE-2019-15867 | High | 8.8 | 2019-09-03 | The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX… |
CVE-2019-15745 | High | 8.8 | 2019-08-29 | The Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. The communica… |
CVE-2019-14943 | Critical | 9.8 | 2019-08-29 | An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.1.4. It uses Hard-coded Credentials. |
CVE-2019-15497 | Critical | 9.8 | 2019-08-26 | Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attack… |
CVE-2019-6698 | Critical | 9.8 | 2019-08-23 | Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementione… |
CVE-2016-10928 | High | 7.5 | 2019-08-22 | The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users. |
CVE-2019-11030 | Critical | 9.8 | 2019-08-22 | Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.dll in AuditTrailService in SMServer.ex… |
CVE-2019-1935 | Critical | 9.8 | 2019-08-21 | A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unau… |
CVE-2019-7594 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management P… |
CVE-2019-7593 | Medium | 6.8 | 2019-08-20 | Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management… |
CVE-2018-20955 | Critical | 9.8 | 2019-08-08 | Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31. |
CVE-2019-12797 | Critical | 9.8 | 2019-07-31 | A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle. |
CVE-2019-12327 | High | 7.2 | 2019-07-22 | Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port… |
CVE-2019-9229 | High | 8.8 | 2019-07-20 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal in… |
CVE-2019-1919 | High | 8.4 | 2019-07-17 | A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to th… |
CVE-2019-3950 | Critical | 9.8 | 2019-07-09 | Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard… |
CVE-2019-13399 | Medium | 5.9 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. |
CVE-2019-13352 | Critical | 9.8 | 2019-07-05 | WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this sta… |
CVE-2018-14528 | Critical | 9.8 | 2019-07-05 | Invoxia NVX220 devices allow TELNET access as admin with a default password. |
CVE-2017-8226 | Critical | 9.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the… |
CVE-2017-8415 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from… |
CVE-2019-7261 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Hard-coded Credentials. |
CVE-2019-7265 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH). |
CVE-2019-10979 | Critical | 9.8 | 2019-07-01 | SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password. |
CVE-2019-7279 | High | 7.3 | 2019-07-01 | Optergy Proton/Enterprise devices have Hard-coded Credentials. |
CVE-2019-7225 | High | 8.8 | 2019-06-27 | The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the p… |
CVE-2019-1619 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass aut… |
CVE-2019-12920 | Critical | 9.8 | 2019-06-20 | On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The d… |
CVE-2019-12550 | Critical | 9.8 | 2019-06-17 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TE… |
CVE-2019-12549 | Critical | 9.8 | 2019-06-17 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH… |
CVE-2019-12776 | Critical | 9.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded… |
CVE-2019-4220 | Medium | 5.5 | 2019-06-06 | IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 15922… |
CVE-2019-7672 | High | 8.8 | 2019-06-05 | Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authen… |
CVE-2019-11947 | High | 8.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-11946 | Medium | 6.5 | 2019-06-05 | A remote credential disclosure vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-12376 | Medium | 4.5 | 2019-06-03 | Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to full managed endpoin… |
CVE-2017-14728 | Critical | 9.8 | 2019-06-03 | An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this expl… |
CVE-2019-6725 | Critical | 9.8 | 2019-05-31 | The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page, the admin user's… |
CVE-2019-10850 | Critical | 9.8 | 2019-05-23 | Computrols CBAS 18.0.0 has Default Credentials. |
CVE-2019-10851 | Medium | 6.5 | 2019-05-23 | Computrols CBAS 18.0.0 has hard-coded encryption keys. |
CVE-2019-6812 | High | 7.2 | 2019-05-22 | A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a confidentiality iss… |
CVE-2019-8352 | Critical | 9.8 | 2019-05-20 | By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Ag… |
CVE-2019-6572 | Critical | 9.1 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2019-10920 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via por… |
CVE-2018-11691 | Critical | 9.8 | 2019-05-14 | Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management pas… |
CVE-2018-4017 | High | 8.8 | 2019-05-13 | An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can pot… |
CVE-2019-6548 | Critical | 9.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the database. This serv… |
CVE-2019-10712 | Critical | 9.8 | 2019-05-07 | The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-… |
CVE-2018-18979 | High | 7.4 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction… |
CVE-2018-18978 | High | 7.4 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the… |
CVE-2018-4062 | High | 8.1 | 2019-05-06 | A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can ca… |
CVE-2017-18374 | High | 8.8 | 2019-05-02 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a h… |
CVE-2017-18373 | High | 8.8 | 2019-05-02 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded se… |
CVE-2017-18371 | Critical | 9.8 | 2019-05-02 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service a… |
CVE-2019-3939 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interface. An un… |
CVE-2019-3938 | High | 7.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via t… |
CVE-2019-3932 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi. A re… |
CVE-2018-18251 | Critical | 9.8 | 2019-04-24 | Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on… |
CVE-2019-7212 | High | 8.2 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. I… |
CVE-2019-10688 | Medium | 6.8 | 2019-04-23 | VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded cre… |
CVE-2019-9160 | Critical | 9.8 | 2019-04-18 | WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP… |
CVE-2019-9975 | High | 7.5 | 2019-04-11 | DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption. Data stored using this key can be decrypted by anyone able to access thi… |
CVE-2019-10479 | Critical | 9.8 | 2019-04-05 | An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacke… |
CVE-2019-3710 | High | 8.1 | 2019-03-28 | Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed… |
CVE-2014-5431 | Medium | 6.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provide… |
CVE-2014-5434 | Critical | 9.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credent… |
CVE-2019-10011 | Critical | 9.8 | 2019-03-25 | ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of ac… |
CVE-2015-3953 | Critical | 9.8 | 2019-03-25 | Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2019-7161 | High | 7.5 | 2019-03-21 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacit… |
CVE-2019-3497 | High | 8.8 | 2019-03-21 | An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to… |
CVE-2019-3496 | High | 8.8 | 2019-03-21 | An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostic_tools_controller Diagnostic Tools Controller is vulnerable… |
CVE-2019-3495 | High | 8.8 | 2019-03-21 | An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable to arbitrary file upload, allowing an a… |
CVE-2018-20219 | High | 8.1 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to… |
CVE-2018-18473 | Critical | 9.8 | 2019-03-21 | A hidden backdoor on PATLITE NH-FB Series devices with firmware version 1.45 or earlier, NH-FV Series devices with firmware version 1.10 or earlier, and NBM Se… |
CVE-2018-17492 | High | 8.4 | 2019-03-21 | EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. |
CVE-2019-1723 | Critical | 9.8 | 2019-03-13 | A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an… |
CVE-2019-3918 | Critical | 9.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH interfaces. |
CVE-2018-1944 | Medium | 5.1 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic ke… |
CVE-2019-8950 | Critical | 9.8 | 2019-02-20 | The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET. |
CVE-2018-15781 | High | 7.9 | 2019-02-13 | The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacke… |
CVE-2019-1688 | High | 7.1 | 2019-02-12 | A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized acc… |
CVE-2009-5154 | Critical | 9.8 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account. |
CVE-2019-1675 | High | 7.5 | 2019-02-07 | A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vuln… |
CVE-2018-18998 | Critical | 9.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges. |
CVE-2018-5560 | Critical | 10.0 | 2019-01-31 | A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla All-In-One Video Security System allows… |
CVE-2018-1959 | Medium | 5.1 | 2019-01-24 | IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou… |
CVE-2019-6499 | High | 8.1 | 2019-01-21 | Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\ser… |