CWE-798 · Use of Hard-coded Credentials (page 6)
Page 6 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37936 | Critical | 9.8 | 2025-01-14 | A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0… |
CVE-2024-57811 | Critical | 9.1 | 2025-01-13 | In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the… |
CVE-2024-46505 | Critical | 9.1 | 2025-01-09 | Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. |
CVE-2024-28778 | Medium | 6.5 | 2025-01-07 | IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to pub… |
CVE-2022-27600 | Medium | 6.8 | 2024-12-19 | An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2024-4996 | Critical | 9.8 | 2024-12-18 | Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data… |
CVE-2024-55557 | Critical | 9.8 | 2024-12-16 | ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials. |
CVE-2024-48007 | Medium | 5.3 | 2024-12-13 | Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit… |
CVE-2024-28146 | High | 8.4 | 2024-12-12 | The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allo… |
CVE-2024-54749 | High | 7.5 | 2024-12-06 | Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: this is dis… |
CVE-2024-54750 | Critical | 9.8 | 2024-12-06 | Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti'… |
CVE-2024-45319 | Medium | 6.3 | 2024-12-05 | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certifi… |
CVE-2024-51551 | Critical | 10.0 | 2024-12-05 | Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected products: ABB ASPE… |
CVE-2024-53614 | Medium | 6.5 | 2024-12-04 | A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges. |
CVE-2024-41777 | High | 7.5 | 2024-12-03 | IBM Cognos Controller 11.0.0 and 11.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound a… |
CVE-2024-53484 | High | 8.8 | 2024-12-02 | Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. |
CVE-2024-49806 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-49805 | Critical | 9.4 | 2024-11-29 | IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ow… |
CVE-2024-50377 | Medium | 6.5 | 2024-11-26 | A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<… |
CVE-2024-36248 | Critical | 9.1 | 2024-11-26 | API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the in… |
CVE-2024-35244 | Critical | 9.1 | 2024-11-26 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the cored… |
CVE-2024-10451 | Medium | 5.9 | 2024-11-25 | A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embe… |
CVE-2024-11630 | High | 7.3 | 2024-11-22 | A vulnerability has been found in E-Lins H685, H685f, H700, H720, H750, H820, H820Q, H820Q0 and H900 up to 3.2 and classified as critical. This vulnerability a… |
CVE-2024-5722 | High | 8.8 | 2024-11-22 | Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2023-51638 | Critical | 9.8 | 2024-11-22 | Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2024-42450 | Critical | 10.0 | 2024-11-19 | The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa Direct… |
CVE-2024-52789 | High | 8.0 | 2024-11-19 | Tenda W30E v2.0 V16.01.0.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. |
CVE-2024-52788 | High | 8.0 | 2024-11-19 | Tenda W9 v1.0.0.7(4456) was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root. |
CVE-2024-49060 | High | 8.8 | 2024-11-15 | Azure Stack HCI Elevation of Privilege Vulnerability |
CVE-2024-48971 | Critical | 9.3 | 2024-11-14 | The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the pa… |
CVE-2024-40410 | Medium | 4.8 | 2024-11-13 | Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption. |
CVE-2024-7295 | High | 7.1 | 2024-11-13 | In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a soph… |
CVE-2024-52295 | Critical | 9.8 | 2024-11-13 | DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is… |
CVE-2024-11026 | Low | 3.7 | 2024-11-08 | A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown function… |
CVE-2024-50593 | High | 7.8 | 2024-11-08 | An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" pass… |
CVE-2024-10920 | Low | 3.1 | 2024-11-06 | A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal… |
CVE-2024-10748 | Low | 2.5 | 2024-11-04 | A vulnerability, which was classified as problematic, has been found in Cosmote Greece What's Up App 4.47.3 on Android. This issue affects some unknown process… |
CVE-2024-51431 | Critical | 9.8 | 2024-11-01 | LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable. |
CVE-2024-31151 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-28875 | High | 8.1 | 2024-10-30 | A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds p… |
CVE-2024-45656 | Critical | 9.8 | 2024-10-29 | IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060… |
CVE-2024-48539 | Critical | 9.8 | 2024-10-24 | Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism. |
CVE-2024-20412 | Critical | 9.3 | 2024-10-23 | A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthenticated, local at… |
CVE-2024-5764 | Medium | 6.5 | 2024-10-23 | Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the N… |
CVE-2024-4740 | Medium | 5.3 | 2024-10-18 | MXsecurity software versions v1.1.0 and prior are vulnerable because of the use of hard-coded credentials. This vulnerability could allow an attacker to tamper… |
CVE-2024-48192 | High | 8.0 | 2024-10-17 | Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root |
CVE-2024-10025 | Critical | 9.1 | 2024-10-17 | A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials… |
CVE-2024-20280 | Medium | 6.3 | 2024-10-16 | A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is… |
CVE-2024-9594 | Medium | 6.3 | 2024-10-15 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when u… |
CVE-2024-9486 | Critical | 9.8 | 2024-10-15 | A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtu… |
CVE-2024-45275 | Critical | 9.8 | 2024-10-15 | The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker for full control of the affected device… |
CVE-2024-7206 | | 2024-10-08 | SSL Pinning Bypass in eWeLink Some hardware products allows local ATTACKER to Decrypt TLS communication and Extract secrets to clone the device via Flash the m… | |
CVE-2024-28812 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credentials allows attack… |
CVE-2024-28809 | High | 8.8 | 2024-09-30 | An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various ap… |
CVE-2024-8450 | High | 8.6 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded community string in the SNMPv1 service, allowing unauthorized remote attackers to use this commu… |
CVE-2024-8449 | Medium | 6.8 | 2024-09-30 | Certain switch models from PLANET Technology have a Hard-coded Credential in the password recovering functionality, allowing an unauthenticated attacker to con… |
CVE-2024-8448 | High | 8.8 | 2024-09-30 | Certain switch models from PLANET Technology have a hard-coded credential in the specific command-line interface, allowing remote attackers with regular privil… |
CVE-2024-23958 | Medium | 6.5 | 2024-09-28 | Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2024-43423 | Critical | 9.8 | 2024-09-25 | The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed. |
CVE-2023-27584 | Critical | 9.8 | 2024-09-19 | Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incub… |
CVE-2024-45861 | High | 7.5 | 2024-09-19 | Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information. |
CVE-2023-41612 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card. |
CVE-2023-41611 | Medium | 6.5 | 2024-09-18 | Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data. |
CVE-2023-41610 | High | 8.8 | 2024-09-18 | Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext. |
CVE-2024-45698 | Critical | 9.8 | 2024-09-16 | Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-code… |
CVE-2024-6656 | Critical | 9.8 | 2024-09-13 | Use of Hard-coded Credentials vulnerability in TNB Mobile Solutions Cockpit Software allows Read Sensitive Strings Within an Executable. This issue affects Co… |
CVE-2024-28990 | Medium | 6.3 | 2024-09-12 | SolarWinds Access Rights Manager (ARM) was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability would… |
CVE-2024-39582 | Low | 2.3 | 2024-09-10 | Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. A high privileged attacker with local access could potentially e… |
CVE-2024-39585 | High | 7.9 | 2024-09-06 | Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. A low privileged at… |
CVE-2024-20439 | Critical | 9.8 | 2024-09-04 | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static admini… |
CVE-2024-35118 | Medium | 4.6 | 2024-08-29 | IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device. |
CVE-2024-6633 | Critical | 9.8 | 2024-08-27 | The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credent… |
CVE-2024-8162 | Critical | 9.8 | 2024-08-26 | A vulnerability classified as critical has been found in TOTOLINK T10 AC1200 4.1.8cu.5207. Affected is an unknown function of the file /squashfs-root/web_cste/… |
CVE-2024-8135 | Medium | 6.3 | 2024-08-24 | A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the… |
CVE-2024-45165 | Medium | 5.3 | 2024-08-22 | An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Data is sent between client and server with encryption. However, the key is derived… |
CVE-2024-28987 | Critical | 9.1 | 2024-08-21 | The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functi… |
CVE-2024-8005 | High | 7.3 | 2024-08-20 | A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.g… |
CVE-2024-42638 | Critical | 9.8 | 2024-08-16 | H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-42637 | Critical | 9.8 | 2024-08-16 | H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-31798 | Medium | 6.8 | 2024-08-15 | Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root passw… |
CVE-2023-20512 | Low | 1.9 | 2024-08-13 | A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug information leakage. |
CVE-2024-41161 | High | 7.5 | 2024-08-08 | Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior… |
CVE-2024-6890 | High | 8.8 | 2024-08-07 | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the… |
CVE-2024-41616 | Critical | 9.8 | 2024-08-06 | D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service. |
CVE-2024-39838 | High | 8.8 | 2024-08-05 | ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an administrative privilege… |
CVE-2024-33895 | Medium | 6.6 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in… |
CVE-2024-7332 | Critical | 9.8 | 2024-08-01 | A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-b… |
CVE-2024-41611 | Critical | 9.8 | 2024-07-30 | In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet servic… |
CVE-2024-41610 | Critical | 9.8 | 2024-07-30 | D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet serv… |
CVE-2024-7170 | Low | 3.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi… |
CVE-2024-7155 | Low | 2.5 | 2024-07-28 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-41689 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An a… |
CVE-2024-6912 | Critical | 9.8 | 2024-07-22 | Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects Proc… |
CVE-2024-5471 | High | 8.8 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. |
CVE-2024-35338 | Critical | 9.8 | 2024-07-16 | Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root. |
CVE-2024-5810 | Medium | 5.3 | 2024-07-09 | The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including… |
CVE-2024-28751 | Critical | 9.1 | 2024-07-09 | An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. |
CVE-2024-28747 | Critical | 9.8 | 2024-07-09 | An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges. |
CVE-2023-46685 | Critical | 9.8 | 2024-07-08 | A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted netwo… |
CVE-2024-4708 | Critical | 9.8 | 2024-07-02 | mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. |