CWE-798 · Use of Hard-coded Credentials (page 8)
Page 8 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49256 | High | 7.5 | 2024-01-12 | It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key. |
CVE-2023-49253 | Critical | 9.8 | 2024-01-12 | Root user password is hardcoded into the device and cannot be changed in the user interface. |
CVE-2023-50124 | Medium | 6.8 | 2024-01-11 | Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. Due to default credentials on a debug interface, in combination with certain design ch… |
CVE-2023-48251 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account. |
CVE-2023-48250 | High | 8.1 | 2024-01-10 | The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. |
CVE-2023-50974 | Medium | 5.5 | 2024-01-09 | In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX… |
CVE-2023-50948 | Medium | 6.5 | 2024-01-08 | IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2023-37608 | High | 7.5 | 2024-01-03 | An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystem… |
CVE-2023-49228 | Medium | 6.4 | 2023-12-28 | An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical ac… |
CVE-2023-46918 | Medium | 4.6 | 2023-12-27 | Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup att… |
CVE-2023-46919 | Medium | 6.3 | 2023-12-27 | Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr… |
CVE-2023-46711 | Medium | 4.6 | 2023-12-26 | VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user. |
CVE-2023-40236 | Medium | 5.3 | 2023-12-25 | In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authentication bypass. |
CVE-2023-47704 | Medium | 4.0 | 2023-12-20 | IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. |
CVE-2023-43870 | High | 8.1 | 2023-12-19 | When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse e… |
CVE-2023-48392 | Critical | 9.8 | 2023-12-15 | Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can gener… |
CVE-2023-48388 | Critical | 9.8 | 2023-12-15 | Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform a… |
CVE-2023-48374 | Medium | 6.5 | 2023-12-15 | SmartStar Software CWS is a web-base integration platform, it has a vulnerability of using a hard-coded for a specific account with low privilege. An unauthent… |
CVE-2023-43583 | Medium | 4.9 | 2023-12-13 | Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user… |
CVE-2023-36651 | High | 7.2 | 2023-12-12 | Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privile… |
CVE-2023-36647 | High | 7.5 | 2023-12-12 | A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary… |
CVE-2023-40300 | Critical | 9.8 | 2023-12-07 | NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key. |
CVE-2023-33413 | High | 8.8 | 2023-12-07 | The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11… |
CVE-2023-39169 | Critical | 9.8 | 2023-12-07 | The affected devices use publicly available default credentials with administrative privileges. |
CVE-2023-6448 | Critical | 9.8 | 2023-12-05 | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with ne… |
CVE-2023-40464 | High | 8.1 | 2023-12-04 | Several versions of ALEOS, including ALEOS 4.16.0, use a hardcoded SSL certificate and private key. An attacker with access to these items coul… |
CVE-2023-40463 | High | 8.1 | 2023-12-04 | When configured in debugging mode by an authenticated user with administrative privileges, ALEOS 4.16 and earlier store the SHA512 hash of the… |
CVE-2023-28895 | Low | 3.5 | 2023-12-01 | The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows… |
CVE-2023-23324 | Critical | 9.8 | 2023-11-29 | Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account. |
CVE-2023-29064 | Medium | 4.1 | 2023-11-28 | The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include… |
CVE-2023-47315 | High | 8.8 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available… |
CVE-2023-36013 | Medium | 6.5 | 2023-11-20 | PowerShell Information Disclosure Vulnerability |
CVE-2023-48055 | High | 7.5 | 2023-11-16 | SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of information and communicatio… |
CVE-2023-48053 | High | 7.5 | 2023-11-16 | Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of informa… |
CVE-2023-47213 | Critical | 9.8 | 2023-11-16 | First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the… |
CVE-2023-44296 | High | 8.4 | 2023-11-16 | Dell ELab-Navigator, version 3.1.9 contains a hard-coded credential vulnerability. A local attacker could potentially exploit this vulnerability, leading to u… |
CVE-2023-40719 | Medium | 4.1 | 2023-11-14 | A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fo… |
CVE-2023-33304 | Medium | 4.4 | 2023-11-14 | A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections v… |
CVE-2023-47800 | Critical | 9.8 | 2023-11-10 | Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to… |
CVE-2023-41137 | High | 8.0 | 2023-11-09 | Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonat… |
CVE-2023-5777 | Critical | 9.8 | 2023-11-06 | Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the… |
CVE-2023-31579 | Critical | 9.8 | 2023-11-02 | Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows at… |
CVE-2023-45499 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials. |
CVE-2018-17558 | Critical | 9.8 | 2023-10-26 | Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6… |
CVE-2023-46102 | High | 8.8 | 2023-10-25 | The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to execute on the HMI… |
CVE-2023-42492 | High | 7.1 | 2023-10-25 | EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key |
CVE-2023-41372 | High | 7.8 | 2023-10-25 | The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client application, induci… |
CVE-2023-31581 | Critical | 9.8 | 2023-10-25 | Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. |
CVE-2023-26219 | High | 7.4 | 2023-10-25 | The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence… |
CVE-2022-22466 | Medium | 6.8 | 2023-10-23 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-41713 | High | 7.5 | 2023-10-17 | SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. |
CVE-2023-33836 | Medium | 5.3 | 2023-10-16 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2023-45194 | Medium | 4.3 | 2023-10-11 | Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier al… |
CVE-2023-30801 | Critical | 9.8 | 2023-10-10 | All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change… |
CVE-2023-45226 | High | 7.4 | 2023-10-10 | The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with th… |
CVE-2023-36380 | Critical | 9.8 | 2023-10-10 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.11 (only with activated debug support)), CP-8050 MASTER MODULE (All ver… |
CVE-2023-2306 | Critical | 10.0 | 2023-10-05 | Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacke… |
CVE-2023-20101 | Critical | 9.8 | 2023-10-04 | A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has… |
CVE-2022-47891 | High | 8.1 | 2023-10-03 | All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery… |
CVE-2023-5318 | High | 7.5 | 2023-09-30 | Use of Hard-coded Credentials in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-20034 | High | 7.5 | 2023-09-27 | Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated, remote attacker to access the Elastics… |
CVE-2023-41878 | Medium | 4.6 | 2023-09-27 | MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance test… |
CVE-2023-43637 | High | 7.8 | 2023-09-21 | Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfooba… |
CVE-2023-5074 | Critical | 9.8 | 2023-09-20 | Use of a static key to protect a JWT token used in user authentication can allow an for an authentication bypass in D-Link D-View 8 v2.0.1.28 |
CVE-2023-31808 | High | 7.2 | 2023-09-19 | Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted ac… |
CVE-2022-47558 | Critical | 9.4 | 2023-09-19 | Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker… |
CVE-2023-41030 | Medium | 6.3 | 2023-09-18 | Hard-coded credentials in Juplink RX4-1500 versions V1.0.2 through V1.0.5 allow unauthenticated attackers to log in to the web interface or telnet service as t… |
CVE-2023-42328 | High | 8.8 | 2023-09-18 | An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded… |
CVE-2023-41595 | High | 7.5 | 2023-09-18 | An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password. |
CVE-2023-42336 | Critical | 9.8 | 2023-09-16 | An issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary code and obtain sensitive information via the password parameter… |
CVE-2023-37755 | Critical | 9.8 | 2023-09-14 | i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask u… |
CVE-2023-40717 | Medium | 5.3 | 2023-09-13 | A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to ac… |
CVE-2023-27169 | Medium | 6.5 | 2023-09-12 | Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric… |
CVE-2023-39422 | Medium | 6.5 | 2023-09-07 | The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a J… |
CVE-2023-39421 | High | 7.7 | 2023-09-07 | The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Von… |
CVE-2023-39420 | Critical | 9.9 | 2023-09-07 | The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresp… |
CVE-2023-32619 | High | 8.8 | 2023-09-06 | Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credential… |
CVE-2023-41508 | Critical | 9.8 | 2023-09-05 | A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel. |
CVE-2023-39982 | High | 7.5 | 2023-09-02 | A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications a… |
CVE-2023-31173 | High | 7.7 | 2023-08-31 | Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. S… |
CVE-2023-23771 | High | 8.4 | 2023-08-29 | Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to di… |
CVE-2023-23770 | Critical | 9.4 | 2023-08-29 | Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technic… |
CVE-2023-38026 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the sys… |
CVE-2023-38024 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can ex… |
CVE-2023-32077 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to intera… |
CVE-2023-4419 | Critical | 9.8 | 2023-08-24 | The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functiona… |
CVE-2022-3744 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to un… |
CVE-2023-37426 | High | 7.4 | 2023-08-22 | EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations… |
CVE-2023-39808 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH servi… |
CVE-2023-4204 | Medium | 5.4 | 2023-08-16 | NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and i… |
CVE-2023-3264 | Medium | 6.7 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database… |
CVE-2023-3262 | Medium | 6.7 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database… |
CVE-2023-22957 | High | 7.5 | 2023-08-11 | An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with ac… |
CVE-2023-22956 | High | 7.5 | 2023-08-11 | An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt enc… |
CVE-2022-44612 | Medium | 5.5 | 2023-08-11 | Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information… |
CVE-2023-37857 | Low | 3.8 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cry… |
CVE-2023-21652 | High | 7.7 | 2023-08-08 | Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use. |
CVE-2023-33372 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacke… |
CVE-2023-33371 | Critical | 9.8 | 2023-08-03 | Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary… |
CVE-2023-37215 | Medium | 6.2 | 2023-07-30 | JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials |