CWE-798 · Use of Hard-coded Credentials (page 5)
Page 5 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-50688 | Critical | 9.8 | 2025-02-26 | SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the clou… |
CVE-2024-52902 | High | 8.8 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could… |
CVE-2024-8893 | High | 7.3 | 2025-02-14 | Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to fully access the we… |
CVE-2024-57790 | Medium | 5.4 | 2025-02-14 | IXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vul… |
CVE-2025-26410 | Critical | 9.8 | 2025-02-11 | The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovered via password crac… |
CVE-2024-28989 | Medium | 5.5 | 2025-02-11 | SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software. |
CVE-2025-1143 | High | 8.4 | 2025-02-11 | Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these cre… |
CVE-2024-46436 | High | 8.3 | 2025-02-10 | Hardcoded credentials in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to gain root access to the device over the telnet service. |
CVE-2024-46433 | High | 8.8 | 2025-02-10 | A default credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using the defaul… |
CVE-2024-46429 | High | 8.8 | 2025-02-10 | A hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management portal using a defaul… |
CVE-2024-36556 | Critical | 9.1 | 2025-02-06 | Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.0_2023.05.24_22.49… |
CVE-2024-51547 | Critical | 9.8 | 2025-02-06 | Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NE… |
CVE-2024-9643 | Critical | 9.8 | 2025-02-04 | The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An att… |
CVE-2024-53357 | High | 7.5 | 2025-01-31 | Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) ad… |
CVE-2024-53356 | Critical | 9.8 | 2025-01-31 | Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate JWT for privilege escalation. The HMAC se… |
CVE-2024-50692 | Medium | 5.4 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inve… |
CVE-2024-50690 | Medium | 6.5 | 2025-01-24 | SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates. |
CVE-2024-55927 | High | 7.6 | 2025-01-23 | A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or for… |
CVE-2024-11147 | High | 7.6 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as r… |
CVE-2024-45832 | Medium | 4.3 | 2025-01-17 | Hard-coded credentials were included as part of the application binary. These credentials served as part of the application authentication flow and communica… |
CVE-2024-48126 | Critical | 9.8 | 2025-01-15 | HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access. |
CVE-2024-50564 | Low | 3.3 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiClientWindows version 7.4.0, 7.2.x all versions, 7.0.x all versions, and 6.4.x all versions may allow a… |
CVE-2023-37936 | Critical | 9.8 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0… |
CVE-2024-57811 | Critical | 9.1 | 2025-01-13 | In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the… |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-28778 | Medium | 6.5 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to pub… |
CVE-2022-27600 | Medium | 6.8 | 2024-12-19 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-4996 | Critical | 9.8 | 2024-12-18 | Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data… |
CVE-2024-55557 | Critical | 9.8 | 2024-12-16 | ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials. |
CVE-2024-48007 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit… |
CVE-2024-28146 | High | 8.4 | 2024-12-12 | The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allo… |
CVE-2024-54749 | High | 7.5 | 2024-12-06 | Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: this is dis… |
CVE-2024-54750 | Critical | 9.8 | 2024-12-06 | Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti'… |
CVE-2024-45319 | Medium | 6.3 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certifi… |
CVE-2024-51551 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-53614 | Medium | 6.5 | 2024-12-04 | A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges. |
CVE-2024-41777 | High | 7.5 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound a… |
CVE-2024-53484 | High | 8.8 | 2024-12-02 | Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. |
CVE-2024-49806 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-49805 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-50377 | Medium | 6.5 | 2024-11-26 | A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<… |
CVE-2024-36248 | Critical | 9.1 | 2024-11-26 | API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the in… |
CVE-2024-35244 | Critical | 9.1 | 2024-11-26 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the cored… |
CVE-2024-10451 | Medium | 5.9 | 2024-11-25 | A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embe… |
CVE-2024-11630 | High | 7.3 | 2024-11-22 | A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical. This vulnerability a… |
CVE-2024-5722 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2023-51638 | Critical | 9.8 | 2024-11-22 | Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2024-42450 | Critical | 10.0 | 2024-11-19 | The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Direct… |
CVE-2024-52789 | High | 8.0 | 2024-11-19 | Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. |
CVE-2024-52788 | High | 8.0 | 2024-11-19 | Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. |
CVE-2024-49060 | High | 8.8 | 2024-11-15 | Azure Stack HCI Elevation of Privilege Vulnerability |
CVE-2024-48971 | Critical | 9.3 | 2024-11-14 | The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the pa… |
CVE-2024-40410 | Medium | 4.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption. |
CVE-2024-7295 | High | 7.1 | 2024-11-13 | In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a soph… |
CVE-2024-52295 | Critical | 9.8 | 2024-11-13 | DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is… |
CVE-2024-11026 | Low | 3.7 | 2024-11-08 | A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown function… |
CVE-2024-50593 | High | 7.8 | 2024-11-08 | An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" pass… |
CVE-2024-10920 | Low | 3.1 | 2024-11-06 | A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal… |
CVE-2024-10748 | Low | 2.5 | 2024-11-04 | A vulnerability, which was classified as problematic, has been found in Cosmote Greece What's Up App 4.47.3 on Android. This issue affects some unknown process… |
CVE-2024-51431 | Critical | 9.8 | 2024-11-01 | LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable. |
CVE-2024-31151 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-28875 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-45656 | Critical | 9.8 | 2024-10-29 | IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060… |
CVE-2024-48539 | Critical | 9.8 | 2024-10-24 | Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism. |
CVE-2024-20412 | Critical | 9.3 | 2024-10-23 | A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local at… |
CVE-2024-5764 | Medium | 6.5 | 2024-10-23 | Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the N… |
CVE-2024-4740 | Medium | 5.3 | 2024-10-18 | MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper… |
CVE-2024-48192 | High | 8.0 | 2024-10-17 | Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root |
CVE-2024-10025 | Critical | 9.1 | 2024-10-17 | A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials… |
CVE-2024-20280 | Medium | 6.3 | 2024-10-16 | A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is… |
CVE-2024-9594 | Medium | 6.3 | 2024-10-15 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when u… |
CVE-2024-9486 | Critical | 9.8 | 2024-10-15 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtu… |
CVE-2024-45275 | Critical | 9.8 | 2024-10-15 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected device… |
CVE-2024-7206 | | 2024-10-08 | SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the m… | |
CVE-2024-28812 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credentials allows attack… |
CVE-2024-28809 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various ap… |
CVE-2024-8450 | High | 8.6 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this commu… |
CVE-2024-8449 | Medium | 6.8 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to con… |
CVE-2024-8448 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privil… |
CVE-2024-23958 | Medium | 6.5 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-43423 | Critical | 9.8 | 2024-09-25 | The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed. |
CVE-2023-27584 | Critical | 9.8 | 2024-09-19 | Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incub… |
CVE-2024-45861 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information. |
CVE-2023-41612 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card. |
CVE-2023-41611 | Medium | 6.5 | 2024-09-18 | Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data. |
CVE-2023-41610 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext. |
CVE-2024-45698 | Critical | 9.8 | 2024-09-16 | Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-code… |
CVE-2024-6656 | Critical | 9.8 | 2024-09-13 | Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable. This issue affects Co… |
CVE-2024-28990 | Medium | 6.3 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would… |
CVE-2024-39582 | Low | 2.3 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. A high privileged attacker with local access could potentially e… |
CVE-2024-39585 | High | 7.9 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. A low privileged at… |
CVE-2024-20439 | Critical | 9.8 | 2024-09-04 | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static admini… |
CVE-2024-35118 | Medium | 4.6 | 2024-08-29 | IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device. |
CVE-2024-6633 | Critical | 9.8 | 2024-08-27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credent… |
CVE-2024-8162 | Critical | 9.8 | 2024-08-26 | A vulnerability classified as critical has been found in TOTOLINK T10 AC1200 4.1.8cu.5207. Affected is an unknown function of the file /squashfs-root/web_cste/… |
CVE-2024-8135 | Medium | 6.3 | 2024-08-24 | A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the… |
CVE-2024-45165 | Medium | 5.3 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived… |
CVE-2024-28987 | Critical | 9.1 | 2024-08-21 | The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functi… |
CVE-2024-8005 | High | 7.3 | 2024-08-20 | A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.g… |
CVE-2024-42638 | Critical | 9.8 | 2024-08-16 | H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |