CWE-798 · Use of Hard-coded Credentials (page 16)
Page 16 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-12797 | Critical | 9.8 | 2019-07-31 | A clone version of an ELM327 OBD2 Bluetooth device has a hardcoded PIN, leading to arbitrary commands to an OBD-II bus of a vehicle. |
CVE-2019-12327 | High | 7.2 | 2019-07-22 | Hardcoded credentials in the Akuvox R50P VoIP phone 50.0.6.156 allow an attacker to get access to the device via telnet. The telnet service is running on port… |
CVE-2019-9229 | High | 8.8 | 2019-07-20 | An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal in… |
CVE-2019-1919 | High | 8.4 | 2019-07-17 | A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to th… |
CVE-2019-3950 | Critical | 9.8 | 2019-07-09 | Arlo Basestation firmware 1.12.0.1_27940 and prior contain a hardcoded username and password combination that allows root access to the device when an onboard… |
CVE-2019-13399 | Medium | 5.9 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. |
CVE-2019-13352 | Critical | 9.8 | 2019-07-05 | WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this sta… |
CVE-2018-14528 | Critical | 9.8 | 2019-07-05 | Invoxia NVX220 devices allow TELNET access as admin with a default password. |
CVE-2017-8226 | Critical | 9.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the… |
CVE-2017-8415 | Critical | 9.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from… |
CVE-2019-7261 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices have Hard-coded Credentials. |
CVE-2019-7265 | Critical | 9.8 | 2019-07-02 | Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH). |
CVE-2019-10979 | Critical | 9.8 | 2019-07-01 | SICK MSC800 all versions prior to Version 4.0, the affected firmware versions contain a hard-coded customer account password. |
CVE-2019-7279 | High | 7.3 | 2019-07-01 | Optergy Proton/Enterprise devices have Hard-coded Credentials. |
CVE-2019-7225 | High | 8.8 | 2019-06-27 | The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the p… |
CVE-2019-1619 | Critical | 9.8 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass aut… |
CVE-2019-12920 | Critical | 9.8 | 2019-06-20 | On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The d… |
CVE-2019-12550 | Critical | 9.8 | 2019-06-17 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via SSH and TE… |
CVE-2019-12549 | Critical | 9.8 | 2019-06-17 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded private keys for the SSH daemon. The fingerprint of the SSH… |
CVE-2019-12776 | Critical | 9.8 | 2019-06-07 | An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded… |
CVE-2019-4220 | Medium | 5.5 | 2019-06-06 | IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensitive information. IBM X-Force ID: 15922… |
CVE-2019-7672 | High | 8.8 | 2019-06-05 | Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authen… |
CVE-2019-11947 | High | 8.8 | 2019-06-05 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-11946 | Medium | 6.5 | 2019-06-05 | A remote credential disclosure vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. |
CVE-2019-12376 | Medium | 4.5 | 2019-06-03 | Use of a hard-coded encryption key in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to full managed endpoin… |
CVE-2017-14728 | Critical | 9.8 | 2019-06-03 | An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affected, prior to the submission of this expl… |
CVE-2019-6725 | Critical | 9.8 | 2019-05-31 | The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. After accessing the page, the admin user's… |
CVE-2019-10850 | Critical | 9.8 | 2019-05-23 | Computrols CBAS 18.0.0 has Default Credentials. |
CVE-2019-10851 | Medium | 6.5 | 2019-05-23 | Computrols CBAS 18.0.0 has hard-coded encryption keys. |
CVE-2019-6812 | High | 7.2 | 2019-05-22 | A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a confidentiality iss… |
CVE-2019-8352 | Critical | 9.8 | 2019-05-20 | By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Ag… |
CVE-2019-6572 | Critical | 9.1 | 2019-05-14 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All ve… |
CVE-2019-10920 | High | 7.5 | 2019-05-14 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Project data stored on the device, which is accessible via por… |
CVE-2018-11691 | Critical | 9.8 | 2019-05-14 | Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management pas… |
CVE-2018-4017 | High | 8.8 | 2019-05-13 | An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can pot… |
CVE-2019-6548 | Critical | 9.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, contains two backdoor accounts with hardcoded credentials, which may allow control over the database. This serv… |
CVE-2019-10712 | Critical | 9.8 | 2019-05-07 | The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-87x (750-… |
CVE-2018-18979 | High | 7.4 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction… |
CVE-2018-18978 | High | 7.4 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the… |
CVE-2018-4062 | High | 8.1 | 2019-05-06 | A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can ca… |
CVE-2017-18374 | High | 8.8 | 2019-05-02 | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords, including a h… |
CVE-2017-18373 | High | 8.8 | 2019-05-02 | The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded se… |
CVE-2017-18371 | Critical | 9.8 | 2019-05-02 | The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service a… |
CVE-2019-3939 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interface. An un… |
CVE-2019-3938 | High | 7.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via t… |
CVE-2019-3932 | Critical | 9.8 | 2019-04-30 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi. A re… |
CVE-2018-18251 | Critical | 9.8 | 2019-04-24 | Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on… |
CVE-2019-7212 | High | 8.2 | 2019-04-24 | SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and file attachments. I… |
CVE-2019-10688 | Medium | 6.8 | 2019-04-23 | VVX products with software versions including and prior to, UCS 5.9.2 with Better Together over Ethernet Connector (BToE) application 3.9.1, use hard-coded cre… |
CVE-2019-9160 | Critical | 9.8 | 2019-04-18 | WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a backdoor account allowing a remote attacker to login to the system via SSH (on TCP… |
CVE-2019-9975 | High | 7.5 | 2019-04-11 | DASAN H660RM devices with firmware 1.03-0022 use a hard-coded key for logs encryption. Data stored using this key can be decrypted by anyone able to access thi… |
CVE-2019-10479 | Critical | 9.8 | 2019-04-05 | An issue was discovered on Glory RBW-100 devices with firmware ISP-K05-02 7.0.0. A hard-coded username and password were identified that allow a remote attacke… |
CVE-2019-3710 | High | 8.1 | 2019-03-28 | Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed… |
CVE-2014-5431 | Medium | 6.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded password, which provide… |
CVE-2014-5434 | Critical | 9.8 | 2019-03-26 | Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 has a default account with hard-coded credent… |
CVE-2019-10011 | Critical | 9.8 | 2019-03-25 | ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of ac… |
CVE-2015-3953 | Critical | 9.8 | 2019-03-25 | Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq I… |
CVE-2019-7161 | High | 7.5 | 2019-03-21 | An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacit… |
CVE-2019-3497 | High | 8.8 | 2019-03-21 | An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to… |
CVE-2019-3496 | High | 8.8 | 2019-03-21 | An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostic_tools_controller Diagnostic Tools Controller is vulnerable… |
CVE-2019-3495 | High | 8.8 | 2019-03-21 | An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable to arbitrary file upload, allowing an a… |
CVE-2018-20219 | High | 8.1 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to… |
CVE-2018-18473 | Critical | 9.8 | 2019-03-21 | A hidden backdoor on PATLITE NH-FB Series devices with firmware version 1.45 or earlier, NH-FV Series devices with firmware version 1.10 or earlier, and NBM Se… |
CVE-2018-17492 | High | 8.4 | 2019-03-21 | EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the application. |
CVE-2019-1723 | Critical | 9.8 | 2019-03-13 | A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an… |
CVE-2019-3918 | Critical | 9.8 | 2019-03-05 | The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 contains multiple hard coded credentials for the Telnet and SSH interfaces. |
CVE-2018-1944 | Medium | 5.1 | 2019-02-21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic ke… |
CVE-2019-8950 | Critical | 9.8 | 2019-02-20 | The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET. |
CVE-2018-15781 | High | 7.9 | 2019-02-13 | The Dell Wyse Password Encoder in ThinLinux2 versions prior to 2.1.0.01 contain a Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacke… |
CVE-2019-1688 | High | 7.1 | 2019-02-12 | A vulnerability in the management web interface of Cisco Network Assurance Engine (NAE) could allow an unauthenticated, local attacker to gain unauthorized acc… |
CVE-2009-5154 | Critical | 9.8 | 2019-02-09 | An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account. |
CVE-2019-1675 | High | 7.5 | 2019-02-07 | A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart the sensor. The vuln… |
CVE-2018-18998 | Critical | 9.8 | 2019-02-05 | LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges. |
CVE-2018-5560 | Critical | 10.0 | 2019-01-31 | A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla All-In-One Video Security System allows… |
CVE-2018-1959 | Medium | 5.1 | 2019-01-24 | IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou… |
CVE-2019-6499 | High | 8.1 | 2019-01-21 | Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\ser… |
CVE-2019-3908 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access… |
CVE-2019-3907 | High | 7.5 | 2019-01-18 | Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and passwor… |
CVE-2019-3906 | High | 8.8 | 2019-01-18 | Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials… |
CVE-2019-0022 | Critical | 10.0 | 2019-01-15 | Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the… |
CVE-2019-0020 | Critical | 10.0 | 2019-01-15 | Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the… |
CVE-2018-16201 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on… |
CVE-2018-16186 | High | 8.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type… |
CVE-2018-1000625 | Critical | 9.8 | 2018-12-28 | Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account. An attacker could exploit this vulnerability to log in as an admin on an… |
CVE-2018-7800 | Critical | 9.8 | 2018-12-24 | A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device. |
CVE-2018-18009 | Critical | 9.8 | 2018-12-21 | dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18008 | Critical | 9.8 | 2018-12-21 | spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-18007 | Critical | 9.8 | 2018-12-21 | atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials. |
CVE-2018-15720 | Critical | 9.8 | 2018-12-20 | Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API. |
CVE-2018-19233 | High | 7.8 | 2018-12-20 | COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in a… |
CVE-2018-18006 | Critical | 9.8 | 2018-12-14 | Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as d… |
CVE-2018-1887 | Medium | 5.9 | 2018-12-13 | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key… |
CVE-2018-1818 | Medium | 5.9 | 2018-12-13 | IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, o… |
CVE-2018-1650 | Medium | 5.9 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the administrator. IBM X-Force… |
CVE-2018-0468 | High | 7.8 | 2018-12-04 | A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local atta… |
CVE-2018-9083 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if t… |
CVE-2018-9073 | Medium | 5.9 | 2018-11-16 | Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow a… |
CVE-2018-0681 | Critical | 9.8 | 2018-11-15 | Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow re… |
CVE-2018-0680 | Critical | 9.8 | 2018-11-15 | Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow re… |
CVE-2018-15439 | Critical | 9.8 | 2018-11-08 | A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an… |