CWE-798 · Use of Hard-coded Credentials (page 18)
Page 18 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-0235 | High | 8.2 | 2018-03-12 | IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, re… |
CVE-2018-1206 | High | 7.8 | 2018-03-12 | Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded datab… |
CVE-2018-7229 | Critical | 9.8 | 2018-03-09 | A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow an unauthenticated, remote… |
CVE-2014-6617 | Critical | 9.8 | 2018-03-09 | Softing FG-100 PB PROFIBUS firmware version FG-x00-PB_V2.02.0.00 contains a hardcoded password for the root account, which allows remote attackers to obtain ad… |
CVE-2018-1216 | Critical | 9.8 | 2018-03-08 | A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA… |
CVE-2018-0141 | High | 8.4 | 2018-03-08 | A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux… |
CVE-2017-1787 | Medium | 4.4 | 2018-03-02 | IBM Publishing Engine 2.1.2 and 6.0.5 contains an undisclosed vulnerability that could allow a local user with administrative privileges to obtain hard coded u… |
CVE-2018-7047 | Critical | 9.8 | 2018-03-01 | An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX c… |
CVE-2017-11634 | Critical | 9.8 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. Remote attackers can discover a weakly encoded admin password by connecting to TCP port 9527 and rea… |
CVE-2017-11632 | Critical | 9.8 | 2018-02-26 | An issue was discovered on Wireless IP Camera 360 devices. A root account with a known SHA-512 password hash exists, which makes it easier for remote attackers… |
CVE-2014-3205 | Critical | 9.8 | 2018-02-23 | backupmgt/pre_connect_check.php in Seagate BlackArmor NAS contains a hard-coded password of '!~@##$$%FREDESWWSED' for a backdoor user. |
CVE-2015-9254 | Critical | 9.8 | 2018-02-20 | Datto ALTO and SIRIS devices have a default VNC password. |
CVE-2017-12726 | High | 7.3 | 2018-02-15 | A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pum… |
CVE-2017-12725 | Medium | 5.6 | 2018-02-15 | A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with… |
CVE-2017-12724 | High | 8.1 | 2018-02-15 | A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server… |
CVE-2018-1214 | High | 7.0 | 2018-02-12 | Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation p… |
CVE-2018-6825 | Critical | 9.8 | 2018-02-09 | An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access. |
CVE-2012-2166 | Critical | 9.8 | 2018-02-08 | IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before level 11.1.1 have hardcoded passwords for… |
CVE-2016-3953 | Critical | 9.8 | 2018-02-06 | The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption k… |
CVE-2018-5797 | High | 7.5 | 2018-02-05 | An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is an Smint_encrypt Hardcoded AES Key that… |
CVE-2018-6387 | Critical | 9.8 | 2018-01-29 | iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices have a hardcoded password of admin for the admin account, a hardcoded password of support for the suppor… |
CVE-2017-1204 | Critical | 9.8 | 2018-01-26 | IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 contains hard-coded credentials. A remote attacker could exploit this vulnerability to gain access to the s… |
CVE-2017-3762 | High | 7.8 | 2018-01-26 | Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encry… |
CVE-2018-5725 | High | 7.5 | 2018-01-16 | MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of the web server. |
CVE-2018-5723 | Critical | 9.8 | 2018-01-16 | MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account. |
CVE-2014-8579 | Critical | 9.8 | 2018-01-05 | TRENDnet TEW-823DRU devices with firmware before 1.00b36 have a hardcoded password of kcodeskcodes for the root account, which makes it easier for remote attac… |
CVE-2017-17107 | Critical | 9.8 | 2017-12-19 | Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password… |
CVE-2017-3186 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default credentials across all devices. A remote att… |
CVE-2017-3184 | Critical | 9.8 | 2017-12-16 | ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unau… |
CVE-2017-14374 | Critical | 9.8 | 2017-12-06 | The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 (aka 2016 R3.20) is protected using a hard-coded password. A remote user with the knowl… |
CVE-2017-2720 | Medium | 5.3 | 2017-11-22 | FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certai… |
CVE-2017-11026 | High | 7.8 | 2017-11-16 | In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing FRP partition using reference FR… |
CVE-2017-12350 | High | 8.2 | 2017-11-16 | A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an affected virtual a… |
CVE-2017-14027 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNe… |
CVE-2017-14021 | Critical | 9.8 | 2017-11-01 | A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4… |
CVE-2017-14376 | High | 7.8 | 2017-11-01 | EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise th… |
CVE-2017-15582 | High | 7.5 | 2017-10-27 | In net.MCrypt in the "Diary with lock" (aka WriteDiary) application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, whi… |
CVE-2017-15909 | Critical | 9.8 | 2017-10-26 | D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access. |
CVE-2017-12317 | Medium | 6.7 | 2017-10-22 | The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local application software. The vuln… |
CVE-2017-10616 | Medium | 5.3 | 2017-10-13 | The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to… |
CVE-2017-12860 | Critical | 9.8 | 2017-10-10 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit cod… |
CVE-2017-12239 | Medium | 6.8 | 2017-09-29 | A vulnerability in motherboard console ports of line cards for Cisco ASR 1000 Series Aggregation Services Routers and Cisco cBR-8 Converged Broadband Routers c… |
CVE-2017-9957 | Critical | 9.8 | 2017-09-26 | A vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the web service contains a hidden system account wit… |
CVE-2017-9956 | High | 7.3 | 2017-09-26 | An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which the system contains a hard-co… |
CVE-2015-4667 | Critical | 9.8 | 2017-09-25 | Multiple hardcoded credentials in Xsuite 2.x. |
CVE-2017-12928 | Critical | 9.8 | 2017-09-21 | A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot Player4 (all known versions) allows remote attackers to log in via SSH and… |
CVE-2017-9649 | Medium | 5.0 | 2017-09-20 | A Use of Hard-Coded Cryptographic Key issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and vari… |
CVE-2017-8772 | Critical | 9.8 | 2017-09-20 | On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root… |
CVE-2017-8771 | Critical | 9.8 | 2017-09-20 | On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root… |
CVE-2017-14143 | Critical | 9.8 | 2017-09-19 | The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass a… |
CVE-2017-14428 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0666 /var/run/hostapd* permissi… |
CVE-2017-14426 | High | 7.8 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have 0644 /var/etc/shadow (aka the /… |
CVE-2017-14422 | High | 7.5 | 2017-09-13 | D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices use the same hardcoded /etc/stunnel… |
CVE-2017-14421 | Critical | 9.8 | 2017-09-13 | D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices have a hardcoded password of wrgac25_dlink.2013gui_dir850l for the Alphanetworks account upon… |
CVE-2017-11351 | Critical | 9.8 | 2017-09-13 | Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account. |
CVE-2017-14116 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with… |
CVE-2017-14115 | High | 8.1 | 2017-09-03 | The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures ssh-permanent-enable WAN SSH log… |
CVE-2014-8426 | Critical | 9.8 | 2017-08-28 | Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. |
CVE-2017-12709 | Medium | 5.3 | 2017-08-25 | A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The… |
CVE-2016-5816 | High | 7.5 | 2017-08-25 | A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5… |
CVE-2017-9852 | Critical | 9.8 | 2017-08-05 | An Incorrect Password Management issue was discovered in SMA Solar Technology products. Default passwords exist that are rarely changed. User passwords will al… |
CVE-2017-10818 | Critical | 9.8 | 2017-08-04 | MaLion for Windows and Mac versions 3.2.1 to 5.2.1 uses a hardcoded cryptographic key which may allow an attacker to alter the connection settings of Terminal… |
CVE-2017-2283 | High | 8.0 | 2017-08-02 | WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the… |
CVE-2017-2280 | High | 8.8 | 2017-08-02 | WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on th… |
CVE-2017-11380 | Critical | 9.8 | 2017-08-01 | Backup archives were found to be encrypted with a static password across different installations, which suggest the same password may be used in all virtual ap… |
CVE-2017-11129 | Critical | 9.8 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with acces… |
CVE-2017-11743 | Critical | 9.8 | 2017-07-31 | MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of th… |
CVE-2017-9488 | High | 8.8 | 2017-07-31 | The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST) and DPC3941T (firmware version DPC3941_2.5s3_PROD_sey) devi… |
CVE-2017-11694 | Critical | 9.1 | 2017-07-28 | MEDHOST Document Management System contains hard-coded credentials that are used for Apache Solr access. An attacker with knowledge of the hard-coded credentia… |
CVE-2017-11693 | Critical | 9.1 | 2017-07-28 | MEDHOST Document Management System contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded cre… |
CVE-2017-11614 | Critical | 9.8 | 2017-07-25 | MEDHOST Connex contains hard-coded credentials that are used for customer database access. An attacker with knowledge of the hard-coded credentials and the abi… |
CVE-2017-7336 | Critical | 9.8 | 2017-07-22 | A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' accou… |
CVE-2017-3222 | Critical | 9.8 | 2017-07-22 | Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute commands on the Microso… |
CVE-2017-9932 | Critical | 9.8 | 2017-07-21 | Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account. |
CVE-2017-11436 | Critical | 9.8 | 2017-07-19 | D-Link DIR-615 before v20.12PTb04 has a second admin account with a 0x1 BACKDOOR value, which might allow remote attackers to obtain access via a TELNET connec… |
CVE-2017-8011 | Critical | 9.8 | 2017-07-17 | EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions… |
CVE-2017-2343 | Critical | 10.0 | 2017-07-17 | The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of… |
CVE-2017-4976 | Critical | 9.8 | 2017-07-09 | EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote attacker with the knowledge of the defau… |
CVE-2017-2236 | Critical | 9.8 | 2017-07-07 | Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier uses hard-code… |
CVE-2017-6022 | Critical | 9.8 | 2017-06-30 | A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Versio… |
CVE-2016-9358 | Critical | 9.8 | 2017-06-30 | A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Maste… |
CVE-2016-8731 | Critical | 9.8 | 2017-06-21 | Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any camer… |
CVE-2016-0726 | Critical | 9.8 | 2017-06-06 | The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to… |
CVE-2017-6039 | Medium | 5.3 | 2017-06-02 | A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow… |
CVE-2017-6131 | Critical | 9.8 | 2017-05-23 | In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used… |
CVE-2017-9132 | High | 7.5 | 2017-05-21 | A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access Points before 2.2.3… |
CVE-2017-7927 | High | 7.3 | 2017-05-06 | A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW… |
CVE-2017-6054 | High | 7.5 | 2017-04-26 | A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption pas… |
CVE-2017-8224 | Critical | 9.8 | 2017-04-25 | Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET. |
CVE-2015-7246 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which mak… |
CVE-2017-8077 | High | 7.5 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firm… |
CVE-2016-1560 | Critical | 9.8 | 2017-04-21 | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in… |
CVE-2017-7462 | Critical | 9.8 | 2017-04-11 | Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory. |
CVE-2017-7648 | High | 8.1 | 2017-04-10 | Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographi… |
CVE-2015-2887 | Critical | 9.8 | 2017-04-10 | iBaby M3S has a password of admin for the backdoor admin account. |
CVE-2015-2885 | Critical | 9.8 | 2017-04-10 | Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the bac… |
CVE-2015-2882 | Critical | 9.8 | 2017-04-10 | Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin f… |
CVE-2015-2881 | Critical | 9.8 | 2017-04-10 | Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account. |
CVE-2017-7576 | Critical | 9.8 | 2017-04-06 | DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) meant to allow the ven… |
CVE-2017-7574 | Critical | 9.8 | 2017-04-06 | Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection… |