CWE-798 · Use of Hard-coded Credentials (page 9)
Page 9 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-20038 | High | 8.8 | 2023-01-20 | A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key u… |
CVE-2022-34462 | High | 8.4 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded cre… |
CVE-2022-34442 | High | 8.0 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-45444 | Critical | 10.0 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the applicati… |
CVE-2023-22495 | Critical | 9.8 | 2023-01-14 | Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this applicatio… |
CVE-2022-39185 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user. |
CVE-2022-34441 | High | 8.0 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34440 | High | 8.4 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of t… |
CVE-2023-21524 | High | 7.8 | 2023-01-10 | Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability |
CVE-2022-36925 | Medium | 4.4 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon… |
CVE-2022-3928 | High | 7.1 | 2023-01-05 | Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the i… |
CVE-2022-3927 | High | 8.0 | 2023-01-05 | The affected products store both public and private key that are used to sign and protect Custom Parameter Set (CPS) file from modification. An attacker that… |
CVE-2021-40342 | High | 7.1 | 2023-01-05 | In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive info… |
CVE-2023-22463 | Critical | 9.8 | 2023-01-04 | KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all onl… |
CVE-2022-47618 | Critical | 9.8 | 2023-01-03 | Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in adminis… |
CVE-2014-125030 | Medium | 6.3 | 2023-01-01 | A vulnerability, which was classified as critical, has been found in taoeffect Empress. Affected by this issue is some unknown functionality. The manipulation… |
CVE-2022-4780 | Medium | 4.5 | 2022-12-29 | ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change. |
CVE-2022-45425 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulner… |
CVE-2022-36222 | High | 8.4 | 2022-12-21 | Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally t… |
CVE-2022-4611 | Medium | 4.3 | 2022-12-19 | A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unkn… |
CVE-2022-37832 | Critical | 9.8 | 2022-12-16 | Mutiny 7.2.0-10788 suffers from Hardcoded root password. |
CVE-2021-35252 | High | 7.5 | 2022-12-16 | Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker… |
CVE-2022-41653 | Critical | 9.8 | 2022-12-13 | Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system. |
CVE-2022-2660 | Critical | 9.8 | 2022-12-13 | Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to dec… |
CVE-2022-34840 | Medium | 6.5 | 2022-12-07 | Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the devic… |
CVE-2022-38337 | Critical | 9.1 | 2022-12-06 | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can… |
CVE-2022-40259 | High | 8.3 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-40242 | High | 7.5 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-44097 | Critical | 9.8 | 2022-11-30 | Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-44096 | Critical | 9.8 | 2022-11-30 | Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-32967 | Low | 2.1 | 2022-11-29 | RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reb… |
CVE-2022-41157 | High | 8.1 | 2022-11-25 | A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to lea… |
CVE-2022-29831 | High | 7.5 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker t… |
CVE-2022-29830 | Critical | 9.1 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related… |
CVE-2022-29829 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fro… |
CVE-2022-29828 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29827 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29825 | Medium | 5.6 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C… |
CVE-2022-40602 | Critical | 9.8 | 2022-11-22 | A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured… |
CVE-2021-34577 | Medium | 6.5 | 2022-11-09 | In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the de… |
CVE-2022-37710 | High | 7.8 | 2022-11-07 | Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft… |
CVE-2022-40263 | Medium | 6.6 | 2022-11-04 | BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensit… |
CVE-2022-20868 | Medium | 4.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance coul… |
CVE-2022-26119 | High | 7.8 | 2022-11-02 | A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish serve… |
CVE-2022-29889 | Critical | 9.8 | 2022-10-25 | A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root passw… |
CVE-2022-29477 | Critical | 9.8 | 2022-10-25 | An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and… |
CVE-2022-38117 | Medium | 5.5 | 2022-10-24 | Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciph… |
CVE-2021-4228 | Medium | 5.8 | 2022-10-24 | Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This… |
CVE-2022-42176 | High | 7.8 | 2022-10-20 | In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access. |
CVE-2022-41540 | Medium | 5.9 | 2022-10-18 | The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the c… |
CVE-2022-42980 | Critical | 9.8 | 2022-10-17 | go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key. |
CVE-2022-38420 | High | 7.5 | 2022-10-14 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in… |
CVE-2022-34425 | High | 7.5 | 2022-10-10 | Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vul… |
CVE-2022-39273 | Medium | 4.8 | 2022-10-06 | FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default… |
CVE-2022-20844 | Medium | 5.3 | 2022-09-30 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2020-15327 | High | 7.5 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication. |
CVE-2020-15326 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem. |
CVE-2022-28812 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentia… |
CVE-2022-22522 | Critical | 9.8 | 2022-09-28 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentia… |
CVE-2022-36159 | High | 8.8 | 2022-09-26 | Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password stren… |
CVE-2022-3214 | Critical | 9.8 | 2022-09-16 | Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to 1… |
CVE-2022-38823 | Critical | 9.8 | 2022-09-16 | In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. |
CVE-2022-35582 | High | 8.8 | 2022-09-13 | Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating system that WAPPLES runs on has a built-i… |
CVE-2022-35413 | Critical | 9.8 | 2022-09-13 | WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (suc… |
CVE-2022-31322 | High | 7.8 | 2022-09-13 | Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged executables. |
CVE-2022-38069 | Medium | 4.3 | 2022-09-13 | Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileg… |
CVE-2022-37857 | High | 7.5 | 2022-09-08 | bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-s… |
CVE-2022-38394 | Critical | 9.8 | 2022-09-08 | Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to exe… |
CVE-2022-40111 | Critical | 9.8 | 2022-09-06 | In TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 in the shadow.sample file, root is hardcoded in the firmware. |
CVE-2022-37841 | High | 7.5 | 2022-09-06 | In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample. |
CVE-2022-36672 | Critical | 9.8 | 2022-09-01 | Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom use… |
CVE-2022-30318 | Critical | 9.8 | 2022-08-31 | Honeywell ControlEdge through R151.1 uses Hard-coded Credentials. According to FSCT-2022-0056, there is a Honeywell ControlEdge hardcoded credentials issue. Th… |
CVE-2022-38116 | Critical | 9.8 | 2022-08-30 | Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker c… |
CVE-2022-36560 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers are able to access the passcodes at /et… |
CVE-2022-36558 | Critical | 9.8 | 2022-08-29 | Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able to access the passcord via the file /et… |
CVE-2022-36616 | High | 7.8 | 2022-08-29 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36615 | High | 7.8 | 2022-08-29 | TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36614 | High | 7.8 | 2022-08-29 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36613 | High | 7.8 | 2022-08-29 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36612 | High | 7.8 | 2022-08-29 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36611 | High | 7.8 | 2022-08-29 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-36610 | High | 7.8 | 2022-08-29 | TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
CVE-2022-31269 | High | 8.2 | 2022-08-25 | Nortek Linear eMerge E3-Series devices through 0.32-09c place admin credentials in /test.txt that allow an attacker to open a building's doors. (This occurs in… |
CVE-2022-30036 | High | 8.8 | 2022-08-21 | MA Lighting grandMA2 Light has a password of root for the root account. NOTE: The vendor's position is that the product was designed for isolated networks. Als… |
CVE-2022-36171 | High | 8.1 | 2022-08-19 | MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion. |
CVE-2022-36170 | High | 8.8 | 2022-08-19 | MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. |
CVE-2022-35540 | Critical | 9.8 | 2022-08-18 | Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access. |
CVE-2022-1400 | High | 7.1 | 2022-08-17 | Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an… |
CVE-2022-35734 | High | 7.5 | 2022-08-16 | 'Hulu / フールー' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerabi… |
CVE-2021-44720 | High | 7.2 | 2022-08-12 | In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Config… |
CVE-2022-35491 | Critical | 9.8 | 2022-08-10 | TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample. |
CVE-2022-22144 | Critical | 9.8 | 2022-08-05 | A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During sys… |
CVE-2022-34993 | Critical | 9.8 | 2022-08-04 | Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample. |
CVE-2022-32965 | Critical | 9.8 | 2022-08-04 | OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitr… |
CVE-2022-35866 | Critical | 9.8 | 2022-08-03 | This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not… |
CVE-2022-30314 | Medium | 4.6 | 2022-07-28 | Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywell Experion PKS Safety Manager hardcoded… |
CVE-2021-22644 | High | 7.5 | 2022-07-28 | Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key. |
CVE-2022-36952 | High | 8.4 | 2022-07-27 | In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9… |
CVE-2022-30274 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. C… |
CVE-2022-30271 | Critical | 9.8 | 2022-07-26 | The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate… |