CWE-798 · Use of Hard-coded Credentials (page 3)
Page 3 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25291 | High | 7.5 | 2026-01-08 | INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device o… |
CVE-2017-20214 | High | 7.5 | 2026-01-08 | FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations. Attackers… |
CVE-2020-36915 | High | 7.5 | 2026-01-06 | Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet… |
CVE-2021-47744 | High | 7.5 | 2025-12-31 | Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the… |
CVE-2025-15371 | High | 7.8 | 2025-12-31 | A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the c… |
CVE-2023-53983 | Critical | 9.8 | 2025-12-30 | Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage… |
CVE-2022-50696 | Critical | 9.8 | 2025-12-30 | SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device op… |
CVE-2025-68926 | Critical | 9.8 | 2025-12-30 | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded stati… |
CVE-2025-15107 | Low | 3.7 | 2025-12-27 | A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the… |
CVE-2025-15105 | Low | 3.7 | 2025-12-27 | A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/… |
CVE-2025-68948 | High | 8.1 | 2025-12-27 | SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded crypto… |
CVE-2019-25241 | Critical | 9.8 | 2025-12-24 | FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can… |
CVE-2018-25138 | Critical | 9.8 | 2025-12-24 | FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploi… |
CVE-2025-33222 | Critical | 9.8 | 2025-12-23 | NVIDIA Isaac Launchable contains a vulnerability where an attacker could exploit a hard-coded credential issue. A successful exploit of this vulnerability migh… |
CVE-2025-67418 | Critical | 9.8 | 2025-12-22 | ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An… |
CVE-2025-56157 | Critical | 9.8 | 2025-12-18 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Suppl… |
CVE-2025-7358 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc. SoliClub allows Authentication Abuse. This issue affects SoliClub: before 5.3… |
CVE-2025-1029 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable. This issue affe… |
CVE-2025-65855 | Medium | 6.6 | 2025-12-17 | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across… |
CVE-2025-14096 | High | 8.4 | 2025-12-17 | A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possibility to extract credential informatio… |
CVE-2025-67809 | Medium | 4.7 | 2025-12-15 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet… |
CVE-2025-36752 | Critical | 9.8 | 2025-12-13 | Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, s… |
CVE-2025-36747 | Critical | 9.8 | 2025-12-13 | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser… |
CVE-2025-14611 | Critical | 9.8 | 2025-12-12 | Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades secur… |
CVE-2025-54947 | Critical | 9.8 | 2025-12-12 | In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the… |
CVE-2025-65823 | Critical | 9.8 | 2025-12-10 | The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved t… |
CVE-2025-13954 | | 2025-12-10 | Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to t… | |
CVE-2025-41696 | Medium | 4.6 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access… |
CVE-2025-40938 | High | 8.1 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could al… |
CVE-2025-14126 | High | 8.8 | 2025-12-06 | A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulati… |
CVE-2025-65730 | High | 8.8 | 2025-12-05 | Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication. |
CVE-2025-66237 | Medium | 6.7 | 2025-12-04 | DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate priv… |
CVE-2025-29268 | Critical | 9.8 | 2025-12-04 | ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library. |
CVE-2025-64778 | High | 7.3 | 2025-12-02 | NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow una… |
CVE-2025-66454 | Medium | 6.5 | 2025-12-02 | Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") th… |
CVE-2025-54341 | Medium | 5.3 | 2025-11-24 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values. |
CVE-2018-25126 | | 2025-11-24 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS com… | |
CVE-2025-63433 | Medium | 4.6 | 2025-11-24 | Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a stat… |
CVE-2025-59669 | Medium | 5.3 | 2025-11-18 | A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may a… |
CVE-2025-64766 | Medium | 5.3 | 2025-11-17 | NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to befo… |
CVE-2025-13252 | High | 7.3 | 2025-11-16 | A vulnerability was found in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Affected by this issue is some unknown functiona… |
CVE-2025-33186 | High | 8.8 | 2025-11-11 | NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, an… |
CVE-2025-42890 | Critical | 10.0 | 2025-11-11 | SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the pos… |
CVE-2025-34501 | | 2025-11-03 | Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet… | |
CVE-2025-62777 | High | 8.8 | 2025-10-28 | Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affect… |
CVE-2025-41109 | Medium | 4.6 | 2025-10-22 | Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of… |
CVE-2025-41722 | High | 7.5 | 2025-10-22 | The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the S… |
CVE-2025-10639 | High | 8.8 | 2025-10-21 | The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network… |
CVE-2025-6950 | | 2025-10-17 | An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret ke… | |
CVE-2025-60639 | Medium | 6.5 | 2025-10-16 | Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26). |
CVE-2025-10850 | Critical | 9.8 | 2025-10-16 | The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded passwor… |
CVE-2025-56749 | Critical | 9.4 | 2025-10-15 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge vali… |
CVE-2025-36087 | High | 8.1 | 2025-10-13 | IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations… |
CVE-2025-11643 | Low | 3.7 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/… |
CVE-2025-61926 | | 2025-10-09 | Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook… | |
CVE-2025-10609 | Medium | 5.9 | 2025-10-03 | Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects Tige… |
CVE-2025-0642 | Medium | 6.3 | 2025-10-02 | Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allow… |
CVE-2025-34223 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain… |
CVE-2025-34209 | High | 7.2 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker image… |
CVE-2025-34196 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain… |
CVE-2025-11126 | Critical | 9.8 | 2025-09-29 | A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation… |
CVE-2025-58385 | High | 7.1 | 2025-09-26 | In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data). |
CVE-2025-58659 | Medium | 5.3 | 2025-09-22 | Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a th… |
CVE-2025-58656 | Medium | 5.3 | 2025-09-22 | Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retri… |
CVE-2025-58269 | Medium | 5.3 | 2025-09-22 | Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP P… |
CVE-2025-57434 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username… |
CVE-2025-57602 | Critical | 9.8 | 2025-09-22 | Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows rem… |
CVE-2025-57601 | Critical | 9.8 | 2025-09-22 | AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When a… |
CVE-2025-52159 | High | 8.8 | 2025-09-19 | Hardcoded credentials in default configuration of PPress 0.0.9. |
CVE-2025-34198 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain sha… |
CVE-2025-34197 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 (VA and SaaS deployments) contain an und… |
CVE-2024-48842 | High | 7.0 | 2025-09-17 | Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions |
CVE-2025-57579 | High | 8.0 | 2025-09-12 | An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password |
CVE-2025-57578 | High | 8.0 | 2025-09-12 | An issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default password |
CVE-2025-57577 | High | 8.0 | 2025-09-12 | An issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the default password. NOTE: the Supplier's position is that their "p… |
CVE-2025-8570 | Critical | 9.8 | 2025-09-11 | The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determin… |
CVE-2025-56466 | High | 7.5 | 2025-09-10 | Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information. |
CVE-2025-55047 | High | 8.4 | 2025-09-09 | CWE-798 Use of Hard-coded Credentials |
CVE-2025-35452 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface. |
CVE-2025-35451 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many… |
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |
CVE-2025-55739 | | 2025-09-05 | api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17… | |
CVE-2025-9696 | | 2025-09-02 | The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker… | |
CVE-2025-9806 | Low | 1.9 | 2025-09-02 | A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administra… |
CVE-2025-9778 | Low | 1.9 | 2025-09-01 | A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Admini… |
CVE-2025-9731 | Low | 2.5 | 2025-08-31 | A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative… |
CVE-2025-9725 | Low | 2.5 | 2025-08-31 | A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interfac… |
CVE-2025-8857 | Critical | 9.8 | 2025-08-29 | Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator… |
CVE-2025-9380 | High | 7.8 | 2025-08-24 | A vulnerability was identified in FNKvision Y215 CCTV Camera 10.194.120.40. Affected by this issue is some unknown functionality of the file /etc/passwd of the… |
CVE-2025-51606 | High | 8.8 | 2025-08-21 | hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled bin… |
CVE-2025-9310 | Medium | 5.3 | 2025-08-21 | A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-9309 | Low | 2.5 | 2025-08-21 | A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing m… |
CVE-2025-33100 | Medium | 6.2 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2025-7342 | High | 7.5 | 2025-08-17 | A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nut… |
CVE-2025-9091 | Low | 2.5 | 2025-08-17 | A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manip… |
CVE-2025-8974 | Low | 3.7 | 2025-08-14 | A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/ja… |
CVE-2025-43982 | Critical | 9.8 | 2025-08-13 | Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be… |
CVE-2025-55279 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could e… | |
CVE-2025-54465 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with phys… |