CWE-798 · Use of Hard-coded Credentials (page 18)
Page 18 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-2236 | Critical | 9.8 | 2017-07-07 | Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier uses hard-code… |
CVE-2017-6022 | Critical | 9.8 | 2017-06-30 | A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Versio… |
CVE-2016-9358 | Critical | 9.8 | 2017-06-30 | A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Maste… |
CVE-2016-8731 | Critical | 9.8 | 2017-06-21 | Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any camer… |
CVE-2016-0726 | Critical | 9.8 | 2017-06-06 | The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to… |
CVE-2017-6039 | Medium | 5.3 | 2017-06-02 | A Use of Hard-Coded Password issue was discovered in Phoenix Broadband PowerAgent SC3 BMS, all versions prior to v6.87. Use of a hard-coded password may allow… |
CVE-2017-6131 | Critical | 9.8 | 2017-05-23 | In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used… |
CVE-2017-9132 | High | 7.5 | 2017-05-21 | A hard-coded credentials issue was discovered on Mimosa Client Radios before 2.2.3, Mimosa Backhaul Radios before 2.2.3, and Mimosa Access Points before 2.2.3… |
CVE-2017-7927 | High | 7.3 | 2017-05-06 | A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW… |
CVE-2017-6054 | High | 7.5 | 2017-04-26 | A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-coded decryption pas… |
CVE-2017-8224 | Critical | 9.8 | 2017-04-25 | Wireless IP Camera (P2P) WIFICAM devices have a backdoor root account that can be accessed with TELNET. |
CVE-2015-7246 | Critical | 9.8 | 2017-04-24 | D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which mak… |
CVE-2017-8077 | High | 7.5 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firm… |
CVE-2016-1560 | Critical | 9.8 | 2017-04-21 | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in… |
CVE-2017-7462 | Critical | 9.8 | 2017-04-11 | Intellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a vendor-supplied CGI script in the web directory. |
CVE-2017-7648 | High | 8.1 | 2017-04-10 | Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographi… |
CVE-2015-2887 | Critical | 9.8 | 2017-04-10 | iBaby M3S has a password of admin for the backdoor admin account. |
CVE-2015-2885 | Critical | 9.8 | 2017-04-10 | Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the bac… |
CVE-2015-2882 | Critical | 9.8 | 2017-04-10 | Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin f… |
CVE-2015-2881 | Critical | 9.8 | 2017-04-10 | Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin account. |
CVE-2017-7576 | Critical | 9.8 | 2017-04-06 | DragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username of energetic and password of wireless) meant to allow the ven… |
CVE-2017-7574 | Critical | 9.8 | 2017-04-06 | Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection… |
CVE-2016-8754 | High | 7.5 | 2017-04-02 | Huawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys are used to encrypt communication data and authenticate differen… |
CVE-2016-10308 | Critical | 9.8 | 2017-03-30 | Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all device… |
CVE-2016-10307 | Critical | 9.8 | 2017-03-30 | Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for w… |
CVE-2016-10306 | Critical | 9.8 | 2017-03-30 | Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET, and gra… |
CVE-2016-10305 | Critical | 9.8 | 2017-03-30 | Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1… |
CVE-2017-6558 | Critical | 9.8 | 2017-03-09 | iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote attackers… |
CVE-2017-6351 | High | 8.1 | 2017-03-06 | The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode… |
CVE-2017-5230 | High | 7.2 | 2017-03-02 | The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiabl… |
CVE-2017-6403 | Critical | 9.8 | 2017-03-02 | An issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0. NetBackup Cloud Storage Service uses a hardcoded username and passw… |
CVE-2017-5167 | High | 8.6 | 2017-02-13 | An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users do not have any option to change their own passwords. |
CVE-2016-8567 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers migh… |
CVE-2016-8361 | High | 8.6 | 2017-02-13 | An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application uses a hard-coded username with no password allowing an atta… |
CVE-2016-5818 | Critical | 9.8 | 2017-02-13 | An issue was discovered in Schneider Electric PowerLogic PM8ECC device 2.651 and older. Undocumented hard-coded credentials allow access to the device. |
CVE-2016-8954 | Critical | 9.8 | 2017-02-08 | IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database. |
CVE-2017-5600 | Critical | 9.8 | 2017-02-02 | The Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to obtain administrative access by leveraging a default privilege… |
CVE-2016-8491 | Critical | 9.1 | 2017-02-01 | The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2016-10179 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607. |
CVE-2016-10177 | Critical | 9.8 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services provide logins to admin with the password admin and root with the p… |
CVE-2016-10125 | High | 8.1 | 2017-01-09 | D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof devices by hijacking a… |
CVE-2015-2867 | Critical | 9.8 | 2017-01-06 | A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote attackers to take complete control of the system. |
CVE-2016-10115 | Critical | 9.8 | 2017-01-04 | NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8… |
CVE-2016-3685 | Medium | 4.7 | 2016-12-14 | SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attacker… |
CVE-2016-9013 | Critical | 9.8 | 2016-12-09 | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests wit… |
CVE-2016-6829 | Critical | 9.8 | 2016-12-09 | The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowba… |
CVE-2016-2948 | High | 7.8 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors. |
CVE-2016-7560 | Critical | 9.8 | 2016-10-05 | The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remot… |
CVE-2016-6532 | Critical | 9.8 | 2016-09-24 | DEXIS Imaging Suite 10 has a hardcoded password for the sa account, which allows remote attackers to obtain administrative access by entering this password in… |
CVE-2016-6530 | Critical | 9.8 | 2016-09-21 | Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers to obtain administra… |
CVE-2016-6535 | Critical | 9.8 | 2016-09-19 | AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging know… |
CVE-2016-5678 | Critical | 9.8 | 2016-08-31 | NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative… |
CVE-2016-5333 | Critical | 9.8 | 2016-08-31 | VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys file, which allows remote attackers to obtain SSH access by lever… |
CVE-2016-5645 | High | 7.3 | 2016-08-24 | Rockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, and 1766-L32BXBA devices have a hardcoded SNMP commu… |
CVE-2016-5081 | Critical | 9.8 | 2016-08-24 | ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session. |
CVE-2016-2310 | Critical | 9.8 | 2016-06-09 | General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware befo… |
CVE-2014-9198 | | 2015-01-27 | The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for… | |
CVE-2014-2350 | | 2014-05-22 | Emerson DeltaV 10.3.1, 11.3, 11.3.1, and 12.3 uses hardcoded credentials for diagnostic services, which allows remote attackers to bypass intended access restr… | |
CVE-2012-4712 | | 2013-02-15 | Moxa EDR-G903 series routers with firmware before 2.11 have a hardcoded account, which allows remote attackers to obtain unspecified device access via unknown… | |
CVE-2012-6428 | | 2012-12-23 | The Carlo Gavazzi EOS-Box stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device w… | |
CVE-2012-3503 | Critical | 9.8 | 2012-08-25 | The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation… |
CVE-2010-2772 | High | 7.8 | 2010-07-22 | Siemens Simatic WinCC and PCS 7 SCADA system uses a hard-coded password, which allows local users to access a back-end database and gain privileges, as demonst… |
CVE-2010-2073 | High | 7.5 | 2010-06-16 | auth_db_config.py in Pyftpd 0.8.4 contains hard-coded usernames and passwords for the (1) test, (2) user, and (3) roxon accounts, which allows remote attackers… |
CVE-2010-1573 | Critical | 9.8 | 2010-06-10 | Linksys WAP54Gv3 firmware 3.04.03 and earlier uses a hard-coded username (Gemtek) and password (gemtekswd) for a debug interface for certain web pages, which a… |
CVE-2008-2369 | Critical | 9.1 | 2008-08-14 | manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and ob… |
CVE-2008-0961 | Critical | 9.8 | 2008-04-14 | EMV DiskXtender 6.20.060 has a hard-coded login and password, which allows remote attackers to bypass authentication via the RPC interface. |
CVE-2008-1160 | Critical | 9.8 | 2008-03-25 | ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attackers to g… |
CVE-2006-7142 | High | 7.8 | 2007-03-07 | The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files, which a… |
CVE-2006-7074 | | 2007-03-02 | admin.php in SmartSiteCMS 1.0 allows remote attackers to bypass authentication and gain administrator privileges by setting the userName cookie. | |
CVE-2007-1063 | | 2007-02-22 | The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a hard-coded username and pass… | |
CVE-2005-3803 | High | 7.5 | 2005-11-24 | Cisco IP Phone (VoIP) 7920 1.0(8) contains certain hard-coded ("fixed") public and private SNMP community strings that cannot be changed, which allows remote a… |
CVE-2005-3716 | High | 7.5 | 2005-11-21 | The SNMP daemon in UTStarcom F1000 VOIP WIFI Phone s2.0 running VxWorks 5.5.1 with kernel WIND 2.6 has hard-coded public credentials that cannot be changed, wh… |
CVE-2005-0496 | Critical | 9.8 | 2005-02-21 | Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back door, which allows remote attackers to access the file system… |
CVE-2000-1139 | | 2001-01-09 | The installation of Microsoft Exchange 2000 before Rev. A creates a user account with a known password, which could allow attackers to gain privileges, aka the… |