CWE-798 · Use of Hard-coded Credentials (page 8)
Page 8 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32619 | High | 8.8 | 2023-09-06 | Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credential… |
CVE-2023-41508 | Critical | 9.8 | 2023-09-05 | A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel. |
CVE-2023-39982 | High | 7.5 | 2023-09-02 | A vulnerability has been identified in MXsecurity versions prior to v1.0.1. The vulnerability may put the confidentiality and integrity of SSH communications a… |
CVE-2023-31173 | High | 7.7 | 2023-08-31 | Use of Hard-coded Credentials vulnerability in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator on Windows allows Authentication Bypass. S… |
CVE-2023-23771 | High | 8.4 | 2023-08-29 | Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for service technicians to di… |
CVE-2023-23770 | Critical | 9.4 | 2023-08-29 | Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing for service technic… |
CVE-2023-38026 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the sys… |
CVE-2023-38024 | Critical | 9.8 | 2023-08-28 | SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can ex… |
CVE-2023-32077 | High | 7.5 | 2023-08-24 | Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to intera… |
CVE-2023-4419 | Critical | 9.8 | 2023-08-24 | The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functiona… |
CVE-2022-3744 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to un… |
CVE-2023-37426 | High | 7.4 | 2023-08-22 | EdgeConnect SD-WAN Orchestrator instances prior to the versions resolved in this advisory were found to have shared static SSH host keys for all installations… |
CVE-2023-39808 | Critical | 9.8 | 2023-08-21 | N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH servi… |
CVE-2023-4204 | Medium | 5.4 | 2023-08-16 | NPort IAW5000A-I/O Series firmware version v2.2 and prior is affected by a hardcoded credential vulnerabilitywhich poses a potential risk to the security and i… |
CVE-2023-3264 | Medium | 6.7 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database… |
CVE-2023-3262 | Medium | 6.7 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database… |
CVE-2023-22957 | High | 7.5 | 2023-08-11 | An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with ac… |
CVE-2023-22956 | High | 7.5 | 2023-08-11 | An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt enc… |
CVE-2022-44612 | Medium | 5.5 | 2023-08-11 | Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information… |
CVE-2023-37857 | Low | 3.8 | 2023-08-09 | In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an authenticated, remote attacker with admin privileges is able to read hardcoded cry… |
CVE-2023-21652 | High | 7.7 | 2023-08-08 | Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use. |
CVE-2023-33372 | Critical | 9.8 | 2023-08-04 | Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacke… |
CVE-2023-33371 | Critical | 9.8 | 2023-08-03 | Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary… |
CVE-2023-37215 | Medium | 6.2 | 2023-07-30 | JBL soundbar multibeam 5.1 - CWE-798: Use of Hard-coded Credentials |
CVE-2023-32227 | Critical | 9.8 | 2023-07-30 | Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded Credentials |
CVE-2023-33744 | Critical | 9.8 | 2023-07-27 | TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671. |
CVE-2023-38433 | High | 7.5 | 2023-07-26 | Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the… |
CVE-2023-35763 | Medium | 5.5 | 2023-07-18 | Iagona ScrutisWeb versions 2.1.37 and prior are vulnerable to a cryptographic vulnerability that could allow an unauthenticated user to decrypt encrypted passw… |
CVE-2023-34123 | High | 7.5 | 2023-07-13 | Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5… |
CVE-2023-37287 | Critical | 9.1 | 2023-07-10 | SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system wit… |
CVE-2023-37286 | Critical | 9.8 | 2023-07-10 | SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized paylo… |
CVE-2023-35987 | Critical | 9.8 | 2023-07-06 | PiiGAB M-Bus contains hard-coded credentials which it uses for authentication. |
CVE-2023-36623 | High | 7.8 | 2023-07-05 | The root password of the Loxone Miniserver Go Gen.2 before 14.2 is calculated using hard-coded secrets and the MAC address. This allows a local user to calcula… |
CVE-2023-34473 | Medium | 6.6 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead… |
CVE-2023-34338 | High | 7.1 | 2023-07-05 | AMI SPx contains a vulnerability in the BMC where an Attacker may cause a use of hard-coded cryptographic key by a hard-coded certificate. A successful exploit… |
CVE-2023-36817 | High | 7.5 | 2023-07-03 | `tktchurch/website` contains the codebase for The King's Temple Church website. In version 0.1.0, a Stripe API key was found in the public code repository of t… |
CVE-2023-28387 | Medium | 5.5 | 2023-06-30 | "NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a l… |
CVE-2023-2611 | Critical | 9.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that… |
CVE-2023-32274 | High | 8.6 | 2023-06-20 | Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and… |
CVE-2023-30904 | Medium | 5.5 | 2023-06-16 | A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information. |
CVE-2023-25187 | Medium | 6.3 | 2023-06-16 | An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. Nokia Single RAN commissioning procedures do not change (factory-time installed)… |
CVE-2023-3237 | Medium | 6.3 | 2023-06-14 | A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/passwo… |
CVE-2023-2637 | High | 7.3 | 2023-06-13 | Rockwell Automation's FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. Hard-coded cryptographic key may lea… |
CVE-2023-33920 | Medium | 6.8 | 2023-06-13 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). The affected devic… |
CVE-2022-47617 | High | 7.2 | 2023-06-02 | Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files us… |
CVE-2023-2061 | Medium | 6.2 | 2023-06-02 | Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Ser… |
CVE-2022-4333 | Critical | 9.8 | 2023-06-01 | Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be dea… |
CVE-2023-33778 | Critical | 9.8 | 2023-06-01 | Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor fi… |
CVE-2023-28937 | High | 8.8 | 2023-06-01 | DataSpider Servista version 4.4 and earlier uses a hard-coded cryptographic key. DataSpider Servista is data integration software. ScriptRunner and ScriptRunne… |
CVE-2023-31184 | Medium | 6.2 | 2023-05-30 | ROZCOM client CWE-798: Use of Hard-coded Credentials |
CVE-2023-1944 | High | 8.4 | 2023-05-24 | This vulnerability enables ssh access to minikube container using a default password. |
CVE-2023-27921 | Medium | 6.5 | 2023-05-23 | JINS MEME CORE Firmware version 2.2.0 and earlier uses a hard-coded cryptographic key, which may lead to data acquired by a sensor of the affected product bein… |
CVE-2023-27512 | High | 7.2 | 2023-05-23 | Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allo… |
CVE-2023-2504 | High | 8.4 | 2023-05-22 | Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials. |
CVE-2023-33236 | Critical | 9.8 | 2023-05-22 | MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT t… |
CVE-2023-30354 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and th… |
CVE-2023-30352 | Critical | 9.8 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed. |
CVE-2023-30351 | High | 7.5 | 2023-05-10 | Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encrypt… |
CVE-2023-26203 | Medium | 6.7 | 2023-05-03 | A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8… |
CVE-2023-26089 | Critical | 9.8 | 2023-05-02 | European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions… |
CVE-2022-41400 | Critical | 9.8 | 2023-04-28 | Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in… |
CVE-2022-41399 | High | 7.5 | 2023-04-28 | The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database conn… |
CVE-2022-41398 | High | 7.5 | 2023-04-28 | The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue… |
CVE-2022-41397 | Critical | 9.8 | 2023-04-28 | The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and… |
CVE-2023-2158 | Critical | 9.8 | 2023-04-27 | Code Dx versions prior to 2023.4.2 are vulnerable to user impersonation attack where a malicious actor is able to gain access to another user's account by craf… |
CVE-2023-2291 | High | 7.8 | 2023-04-26 | Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine… |
CVE-2022-39989 | Critical | 9.8 | 2023-04-26 | An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the… |
CVE-2022-45291 | High | 7.2 | 2023-04-25 | PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attac… |
CVE-2023-2138 | Critical | 9.8 | 2023-04-18 | Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2. |
CVE-2023-24501 | Critical | 9.8 | 2023-04-17 | Electra Central AC unit – Hardcoded Credentials in unspecified code used by the unit. |
CVE-2022-37255 | High | 7.5 | 2023-04-16 | TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. |
CVE-2023-22429 | High | 7.8 | 2023-04-11 | Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local at… |
CVE-2023-1748 | Critical | 9.3 | 2023-04-04 | The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the a… |
CVE-2023-28503 | Critical | 9.8 | 2023-03-29 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication… |
CVE-2023-28654 | Critical | 9.8 | 2023-03-28 | Osprey Pump Controller version 1.01 has a hidden administrative account that has the hardcoded password that allows full access to the web management interface… |
CVE-2022-22512 | Critical | 9.8 | 2023-03-23 | Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the W… |
CVE-2023-0391 | High | 8.1 | 2023-03-21 | MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of Clou… |
CVE-2023-26511 | Critical | 9.8 | 2023-03-14 | A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain access to the admin p… |
CVE-2023-27583 | Critical | 9.8 | 2023-03-13 | PanIndex is a network disk directory index. In Panindex prior to version 3.1.3, a hard-coded JWT key `PanIndex` is used. An attacker can use the hard-coded JW… |
CVE-2023-1269 | Critical | 9.8 | 2023-03-08 | Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. |
CVE-2023-22344 | Critical | 9.8 | 2023-03-06 | Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to obta… |
CVE-2023-25823 | Medium | 5.4 | 2023-02-23 | Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-cod… |
CVE-2023-26462 | High | 8.1 | 2023-02-23 | ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored… |
CVE-2022-46637 | Critical | 9.8 | 2023-02-21 | Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services. |
CVE-2022-3089 | Medium | 6.3 | 2023-02-13 | Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and pass… |
CVE-2023-0808 | Low | 3.9 | 2023-02-13 | A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unkn… |
CVE-2022-34449 | Medium | 6.0 | 2023-02-11 | PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenticated admin users can exploit the issue… |
CVE-2022-34386 | Medium | 5.5 | 2023-02-11 | Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnera… |
CVE-2022-45766 | Critical | 9.1 | 2023-02-10 | Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impa… |
CVE-2023-21426 | Medium | 4.3 | 2023-02-09 | Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN. |
CVE-2021-36224 | Critical | 9.8 | 2023-02-06 | Western Digital My Cloud devices before OS5 have a nobody account with a blank password. |
CVE-2023-24155 | Critical | 9.8 | 2023-02-03 | TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini. |
CVE-2023-24149 | Critical | 9.8 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow. |
CVE-2023-24147 | High | 7.5 | 2023-02-03 | TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini. |
CVE-2022-48113 | Critical | 9.8 | 2023-02-02 | A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers… |
CVE-2023-23132 | High | 7.5 | 2023-02-01 | Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys. |
CVE-2022-42973 | High | 7.8 | 2023-02-01 | A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affecte… |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2022-48067 | Medium | 5.5 | 2023-01-27 | An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack. |
CVE-2023-24022 | Critical | 10.0 | 2023-01-26 | Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered a… |