CWE-798 · Use of Hard-coded Credentials (page 6)
Page 6 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8005 | High | 7.3 | 2024-08-20 | A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.g… |
CVE-2024-42638 | Critical | 9.8 | 2024-08-16 | H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-42637 | Critical | 9.8 | 2024-08-16 | H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-31798 | Medium | 6.8 | 2024-08-15 | Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root passw… |
CVE-2023-20512 | Low | 1.9 | 2024-08-13 | A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug information leakage. |
CVE-2024-41161 | High | 7.5 | 2024-08-08 | Use of hard-coded credentials vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior… |
CVE-2024-6890 | High | 8.8 | 2024-08-07 | Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the… |
CVE-2024-41616 | Critical | 9.8 | 2024-08-06 | D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service. |
CVE-2024-39838 | High | 8.8 | 2024-08-05 | ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an administrative privilege… |
CVE-2024-33895 | Medium | 6.6 | 2024-08-02 | Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in… |
CVE-2024-7332 | Critical | 9.8 | 2024-08-01 | A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-b… |
CVE-2024-41611 | Critical | 9.8 | 2024-07-30 | In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet servic… |
CVE-2024-41610 | Critical | 9.8 | 2024-07-30 | D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely to the Telnet serv… |
CVE-2024-7170 | Low | 3.5 | 2024-07-28 | A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the file /web_cste/cgi… |
CVE-2024-7155 | Low | 2.5 | 2024-07-28 | A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2024-41689 | Medium | 4.6 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to unencrypted storing of WPA/ WPS credentials within the router's firmware/ database. An a… |
CVE-2024-6912 | Critical | 9.8 | 2024-07-22 | Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects Proc… |
CVE-2024-5471 | High | 8.8 | 2024-07-17 | Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys. |
CVE-2024-35338 | Critical | 9.8 | 2024-07-16 | Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root. |
CVE-2024-5810 | Medium | 5.3 | 2024-07-09 | The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including… |
CVE-2024-28751 | Critical | 9.1 | 2024-07-09 | An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. |
CVE-2024-28747 | Critical | 9.8 | 2024-07-09 | An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges. |
CVE-2023-46685 | Critical | 9.8 | 2024-07-08 | A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted netwo… |
CVE-2024-4708 | Critical | 9.8 | 2024-07-02 | mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device. |
CVE-2023-41919 | Critical | 9.8 | 2024-07-02 | Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. |
CVE-2024-38480 | Medium | 4.0 | 2024-07-01 | "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the AP… |
CVE-2024-39208 | Critical | 9.8 | 2024-06-27 | luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials. |
CVE-2024-39374 | Critical | 9.8 | 2024-06-27 | TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed through the use of hard-coded credentials. |
CVE-2024-0949 | Critical | 9.8 | 2024-06-27 | Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows… |
CVE-2024-33329 | High | 7.5 | 2024-06-26 | A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information. |
CVE-2024-5460 | High | 8.1 | 2024-06-26 | A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow… |
CVE-2023-6198 | Critical | 9.3 | 2024-06-25 | Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device. |
CVE-2024-36496 | High | 7.5 | 2024-06-24 | The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The applic… |
CVE-2024-36480 | Critical | 9.8 | 2024-06-19 | Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain L… |
CVE-2024-6045 | High | 8.8 | 2024-06-17 | Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the de… |
CVE-2024-38466 | Critical | 9.8 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password. |
CVE-2024-27170 | High | 7.4 | 2024-06-14 | It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with W… |
CVE-2024-27168 | High | 7.1 | 2024-06-14 | It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and re… |
CVE-2024-27161 | Medium | 6.2 | 2024-06-14 | all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. I… |
CVE-2024-27160 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-27159 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-37630 | High | 8.8 | 2024-06-13 | D-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as root. |
CVE-2024-38281 | Critical | 9.8 | 2024-06-13 | An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device. |
CVE-2024-0865 | High | 7.8 | 2024-06-12 | CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. |
CVE-2024-29855 | Critical | 9.0 | 2024-06-11 | Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator |
CVE-2024-3700 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all S… |
CVE-2024-3699 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all d… |
CVE-2024-1228 | Critical | 9.8 | 2024-06-10 | Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all E… |
CVE-2023-49224 | High | 8.0 | 2024-06-07 | Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root p… |
CVE-2023-49223 | High | 8.8 | 2024-06-07 | Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd… |
CVE-2023-49222 | High | 8.8 | 2024-06-07 | Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privilege… |
CVE-2023-49221 | High | 7.8 | 2024-06-07 | Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service m… |
CVE-2024-3408 | Critical | 9.8 | 2024-06-06 | man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability ar… |
CVE-2024-29170 | High | 8.1 | 2024-06-04 | Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. An adjacent network unauthenticated attacker could… |
CVE-2024-36782 | Critical | 9.8 | 2024-06-03 | TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. |
CVE-2024-5514 | Critical | 9.8 | 2024-05-30 | MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management… |
CVE-2024-36049 | Medium | 6.5 | 2024-05-24 | Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the dat… |
CVE-2024-35396 | Critical | 9.8 | 2024-05-24 | TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to lo… |
CVE-2024-32988 | High | 7.5 | 2024-05-22 | 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT… |
CVE-2024-4844 | High | 7.5 | 2024-05-16 | Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privil… |
CVE-2024-32053 | Critical | 9.8 | 2024-05-15 | Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in… |
CVE-2024-27107 | Critical | 9.6 | 2024-05-14 | Weak account password in GE HealthCare EchoPAC products |
CVE-2024-32740 | Critical | 9.8 | 2024-05-14 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker coul… |
CVE-2024-34219 | High | 8.6 | 2024-05-14 | TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet. |
CVE-2024-31810 | Critical | 9.8 | 2024-05-14 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2024-23473 | High | 8.6 | 2024-05-14 | The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows… |
CVE-2023-26566 | High | 8.6 | 2024-05-14 | Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure A… |
CVE-2023-51629 | High | 8.8 | 2024-05-03 | D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on a… |
CVE-2023-51588 | High | 7.8 | 2024-05-03 | Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escala… |
CVE-2023-44411 | Critical | 9.8 | 2024-05-03 | D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authen… |
CVE-2023-39482 | Medium | 6.5 | 2024-05-03 | Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2023-39458 | Medium | 5.3 | 2024-05-03 | Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2023-35724 | High | 8.8 | 2024-05-03 | D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass aut… |
CVE-2023-34284 | Medium | 6.3 | 2024-05-03 | NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication… |
CVE-2023-32145 | High | 8.8 | 2024-05-03 | D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on aff… |
CVE-2024-3544 | High | 7.5 | 2024-05-02 | Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines… |
CVE-2023-52723 | High | 7.1 | 2024-04-29 | In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a passw… |
CVE-2024-22813 | Medium | 4.4 | 2024-04-22 | An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting netw… |
CVE-2024-29966 | High | 7.5 | 2024-04-19 | Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerabilit… |
CVE-2024-29963 | Low | 1.9 | 2024-04-19 | Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries… |
CVE-2024-29960 | Medium | 6.8 | 2024-04-19 | In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnn… |
CVE-2024-21990 | Medium | 5.4 | 2024-04-17 | ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deplo… |
CVE-2023-40146 | Medium | 6.8 | 2024-04-17 | A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument… |
CVE-2024-31873 | High | 7.5 | 2024-04-10 | IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtai… |
CVE-2024-29063 | High | 7.3 | 2024-04-09 | Azure AI Search Information Disclosure Vulnerability |
CVE-2024-3272 | Critical | 9.8 | 2024-04-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to… |
CVE-2024-3130 | Medium | 5.7 | 2024-04-01 | Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryptio… |
CVE-2024-2161 | Critical | 9.8 | 2024-03-21 | Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40… |
CVE-2024-22083 | Medium | 6.5 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further a… |
CVE-2024-27774 | High | 7.5 | 2024-03-18 | Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside D… |
CVE-2023-38535 | Medium | 4.7 | 2024-03-13 | Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryp… |
CVE-2024-28194 | Critical | 9.1 | 2024-03-13 | your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authen… |
CVE-2023-5456 | High | 8.1 | 2024-03-05 | A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the d… |
CVE-2024-25731 | High | 7.5 | 2024-03-05 | The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus… |
CVE-2024-24681 | Critical | 9.8 | 2024-02-23 | An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single… |
CVE-2024-1661 | Low | 2.5 | 2024-02-20 | A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the… |
CVE-2024-1344 | Medium | 6.8 | 2024-02-19 | Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password… |
CVE-2023-6255 | High | 7.5 | 2024-02-15 | Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This iss… |
CVE-2024-0390 | Critical | 9.8 | 2024-02-15 | INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation dev… |
CVE-2023-4539 | High | 7.5 | 2024-02-15 | Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data s… |