CWE-798 · Use of Hard-coded Credentials (page 17)
Page 17 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17540 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2017-17539 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2018-10723 | Critical | 9.8 | 2018-05-05 | Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql. |
CVE-2018-8857 | High | 7.8 | 2018-05-04 | Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.2.4 and prior, and… |
CVE-2018-10167 | High | 7.5 | 2018-05-03 | The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptogr… |
CVE-2018-6401 | Critical | 9.8 | 2018-05-02 | Meross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an undocumented admin account with a blank password. |
CVE-2017-14014 | Medium | 4.6 | 2018-05-01 | Boston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI prior to having it transferred to removable media. CVSS v3 ba… |
CVE-2018-10575 | Critical | 9.8 | 2018-04-30 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credentials exist for an unprivileged SSH accoun… |
CVE-2017-9656 | Critical | 9.1 | 2018-04-24 | The backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069 uses hard-coded credentials for a database account with privi… |
CVE-2018-10328 | High | 7.4 | 2018-04-24 | Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream. |
CVE-2018-7241 | Critical | 9.8 | 2018-04-18 | Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communicati… |
CVE-2014-3413 | Critical | 9.8 | 2018-04-05 | The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain… |
CVE-2016-8717 | Critical | 9.8 | 2018-04-02 | An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system… |
CVE-2018-9149 | Medium | 6.8 | 2018-04-01 | The Zyxel Multy X (AC3000 Tri-Band WiFi System) device doesn't use a suitable mechanism to protect the UART. After an attacker dismantles the device and uses a… |
CVE-2018-9161 | Critical | 9.8 | 2018-03-31 | Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scri… |
CVE-2018-0150 | Critical | 9.8 | 2018-03-28 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Soft… |
CVE-2018-5768 | Critical | 9.8 | 2018-03-20 | A remote, unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter for the COOKIE heade… |
CVE-2017-14008 | Critical | 9.8 | 2018-03-20 | GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials. Successful exploit… |
CVE-2017-14006 | Critical | 9.8 | 2018-03-20 | GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Succe… |
CVE-2017-14004 | Critical | 9.8 | 2018-03-20 | GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful exploitation of this vu… |
CVE-2017-14002 | Critical | 9.8 | 2018-03-20 | GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credentials. Successful exp… |
CVE-2018-5552 | Low | 2.9 | 2018-03-19 | Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pe… |
CVE-2018-5551 | Critical | 9.0 | 2018-03-19 | Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contain three credentials with known passwords: QD… |
CVE-2017-8013 | Critical | 9.8 | 2018-03-16 | EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. A… |
CVE-2016-0235 | High | 8.2 | 2018-03-12 | IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, re… |
CVE-2018-1206 | High | 7.8 | 2018-03-12 | Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded datab… |
CVE-2018-7229 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote… |
CVE-2014-6617 | Critical | 9.8 | 2018-03-09 | Softing FG-100 PB PROFIBUS firmware version FG-x00-PB_V2.02.0.00 contains a hardcoded password for the root account, which allows remote attackers to obtain ad… |
CVE-2018-1216 | Critical | 9.8 | 2018-03-08 | A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA… |
CVE-2018-0141 | High | 8.4 | 2018-03-08 | A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux… |
CVE-2017-1787 | Medium | 4.4 | 2018-03-02 | IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded u… |
CVE-2018-7047 | Critical | 9.8 | 2018-03-01 | An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX c… |
CVE-2017-11634 | Critical | 9.8 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin password by connecting to TCP port 9527 and rea… |
CVE-2017-11632 | Critical | 9.8 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, which makes it easier for remote attackers… |
CVE-2014-3205 | Critical | 9.8 | 2018-02-23 | backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user. |
CVE-2015-9254 | Critical | 9.8 | 2018-02-20 | Datto ALTO and SIRIS devices have a default VNC password. |
CVE-2017-12726 | High | 7.3 | 2018-02-15 | A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pum… |
CVE-2017-12725 | Medium | 5.6 | 2018-02-15 | A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with… |
CVE-2017-12724 | High | 8.1 | 2018-02-15 | A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server… |
CVE-2018-1214 | High | 7.0 | 2018-02-12 | Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation p… |
CVE-2018-6825 | Critical | 9.8 | 2018-02-09 | An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access. |
CVE-2012-2166 | Critical | 9.8 | 2018-02-08 | IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before level 11.1.1 have hardcoded passwords for… |
CVE-2016-3953 | Critical | 9.8 | 2018-02-06 | The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption k… |
CVE-2018-5797 | High | 7.5 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is an Smint_encrypt Hardcoded AES Key that… |
CVE-2018-6387 | Critical | 9.8 | 2018-01-29 | iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the suppor… |
CVE-2017-1204 | Critical | 9.8 | 2018-01-26 | IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. A remote attacker could exploit this vulnerability to gain access to the s… |
CVE-2017-3762 | High | 7.8 | 2018-01-26 | Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encry… |
CVE-2018-5725 | High | 7.5 | 2018-01-16 | MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of the web server. |
CVE-2018-5723 | Critical | 9.8 | 2018-01-16 | MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account. |
CVE-2014-8579 | Critical | 9.8 | 2018-01-05 | TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easier for remote attac… |
CVE-2017-17107 | Critical | 9.8 | 2017-12-19 | Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password… |
CVE-2017-3186 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote att… |
CVE-2017-3184 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unau… |
CVE-2017-14374 | Critical | 9.8 | 2017-12-06 | The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowl… |
CVE-2017-2720 | Medium | 5.3 | 2017-11-22 | FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certai… |
CVE-2017-11026 | High | 7.8 | 2017-11-16 | In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing FRP partition using reference FR… |
CVE-2017-12350 | High | 8.2 | 2017-11-16 | A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual a… |
CVE-2017-14027 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNe… |
CVE-2017-14021 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4… |
CVE-2017-14376 | High | 7.8 | 2017-11-01 | EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise th… |
CVE-2017-15582 | High | 7.5 | 2017-10-27 | In net.MCrypt in the "Diary with lock" (aka WriteDiary) application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, whi… |
CVE-2017-15909 | Critical | 9.8 | 2017-10-26 | D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access. |
CVE-2017-12317 | Medium | 6.7 | 2017-10-22 | The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vuln… |
CVE-2017-10616 | Medium | 5.3 | 2017-10-13 | The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to… |
CVE-2017-12860 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-12239 | Medium | 6.8 | 2017-09-29 | A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged Broadband Routers c… |
CVE-2017-9957 | Critical | 9.8 | 2017-09-26 | A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account wit… |
CVE-2017-9956 | High | 7.3 | 2017-09-26 | An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-co… |
CVE-2015-4667 | Critical | 9.8 | 2017-09-25 | Multiple hardcoded credentials in Xsuite 2.x. |
CVE-2017-12928 | Critical | 9.8 | 2017-09-21 | A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot Player4 (all known versions) allows remote attackers to log in via SSH and… |
CVE-2017-9649 | Medium | 5.0 | 2017-09-20 | A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and vari… |
CVE-2017-8772 | Critical | 9.8 | 2017-09-20 | On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root… |
CVE-2017-8771 | Critical | 9.8 | 2017-09-20 | On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root… |
CVE-2017-14143 | Critical | 9.8 | 2017-09-19 | The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass a… |
CVE-2017-14428 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/hostapd* permissi… |
CVE-2017-14426 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /… |
CVE-2017-14422 | High | 7.5 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel… |
CVE-2017-14421 | Critical | 9.8 | 2017-09-13 | D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon… |
CVE-2017-11351 | Critical | 9.8 | 2017-09-13 | Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account. |
CVE-2017-14116 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with… |
CVE-2017-14115 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH log… |
CVE-2014-8426 | Critical | 9.8 | 2017-08-28 | Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. |
CVE-2017-12709 | Medium | 5.3 | 2017-08-25 | A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The… |
CVE-2016-5816 | High | 7.5 | 2017-08-25 | A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5… |
CVE-2017-9852 | Critical | 9.8 | 2017-08-05 | An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will al… |
CVE-2017-10818 | Critical | 9.8 | 2017-08-04 | MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal… |
CVE-2017-2283 | High | 8.0 | 2017-08-02 | WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the… |
CVE-2017-2280 | High | 8.8 | 2017-08-02 | WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on th… |
CVE-2017-11380 | Critical | 9.8 | 2017-08-01 | Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual ap… |
CVE-2017-11129 | Critical | 9.8 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with acces… |
CVE-2017-11743 | Critical | 9.8 | 2017-07-31 | MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of th… |
CVE-2017-9488 | High | 8.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devi… |
CVE-2017-11694 | Critical | 9.1 | 2017-07-28 | MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentia… |
CVE-2017-11693 | Critical | 9.1 | 2017-07-28 | MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded cre… |
CVE-2017-11614 | Critical | 9.8 | 2017-07-25 | MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the abi… |
CVE-2017-7336 | Critical | 9.8 | 2017-07-22 | A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' accou… |
CVE-2017-3222 | Critical | 9.8 | 2017-07-22 | Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microso… |
CVE-2017-9932 | Critical | 9.8 | 2017-07-21 | Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account. |
CVE-2017-11436 | Critical | 9.8 | 2017-07-19 | D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connec… |
CVE-2017-8011 | Critical | 9.8 | 2017-07-17 | EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions… |