CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- d-link dvg-n5402sp firmwareD-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of...9.8 Critical
- tp-link tl-sg108e firmwareOn the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with...7.5 High
- exagrid ex10000e firmware, ex13000e firmware, ex21000e firmware +5 more +7 moreExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the...9.8 Critical
- intellinet-network nfc-30ir firmwareIntellinet NFC-30ir IP Camera has a vendor backdoor that can allow a remote attacker access to a...9.8 Critical
- foscam c1, c1 lite, c2 +9 more +11 moreFoscam networked devices use the same hardcoded SSL private key across different customers'...8.1 High
- ibaby m3s baby monitor firmwareiBaby M3S has a password of admin for the backdoor admin account.9.8 Critical
- lens laboratories peek-a-view firmwareLens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for...9.8 Critical
- philips in.sight b120\\37Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of ...9.8 Critical
- gynoii gcw-1010, gcw-1020, gpw-1025 +2 moreGynoii has a password of guest for the backdoor guest account and a password of 12345 for the...9.8 Critical
- dragonwavex horizon wireless radio firmwareDragonWave Horizon 1.01.03 wireless radios have hardcoded login credentials (such as the username...9.8 Critical
- schneider-electric somachine, modicon tm221ce16r firmware +1 moreSchneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3...9.8 Critical
- huawei oceanstor 5600 v3 firmwareHuawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys...7.5 High
- siklu etherhaul firmwareSiklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account,...9.8 Critical
- gotrango apex lynx firmware, apex orion firmware, giga lynx firmware +2 more +4 moreTrango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have...9.8 Critical
- trango a600 firmwareTrango Altum AC600 devices have a built-in, hidden root account, with a default password of...9.8 Critical
- gotrango apex firmware, apex lynx firmware, apex orion firmware +8 more +10 moreTrango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx...9.8 Critical
- iball ib-wra150n firmwareiball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an...9.8 Critical
- wepresent wipg-1500 firmwareThe WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a...8.1 High
- rapid7 nexposeThe Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted...7.2 High
- veritas netbackup, netbackup appliance +1 moreAn issue was discovered in Veritas NetBackup Before 8.0 and NetBackup Appliance Before 3.0....9.8 Critical
- binom3 universal multifunctional electric power quality meter firmwareAn issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter. Users...8.6 High
- siemens sicam pas\/pqsAn issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded...9.8 Critical
- lynxspring jenesys bas bridgeAn issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The...8.6 High
- schneider-electric powerlogic pm8ecc firmwareAn issue was discovered in Schneider Electric PowerLogic PM8ECC device 2.651 and older....9.8 Critical
- ibm dashdb localIBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to...9.8 Critical
- netapp oncommand insightThe Data Warehouse component in NetApp OnCommand Insight before 7.2.3 allows remote attackers to...9.8 Critical
- fortinet fortiwlcThe presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain...9.1 Critical
- dlink dwr-932b firmwareAn issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607.7.5 High
- dlink dwr-932b firmwareAn issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services...9.8 Critical
- dlink dgs-1100 firmwareD-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which...8.1 High
- trane comfortlink ii scc firmware, comfortlink ii firmware +1 moreA design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote...9.8 Critical
- netgear arlo base station firmware, arlo q camera firmware, arlo q plus camera firmware +2 moreNETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8...9.8 Critical
- sap download managerSAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on...4.7 Medium
- barclamp-trove project barclamp-trove, crowbar-openstack project crowbar-openstack +1 moreThe trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp...9.8 Critical
- ibm bigfix remote controlIBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via...7.8 High
- djangoproject django, canonical ubuntu linux, fedoraproject fedora +2 moreDjango user with hardcoded password created when running tests on Oracle9.8 Critical
- fortinet fortiwlcThe rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0,...9.8 Critical
- dexis imaging suiteDEXIS Imaging Suite 10 has a hardcoded password for the sa account, which allows remote attackers...9.8 Critical
- dentsply sirona cdr dicomDentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and...9.8 Critical
- aver eh6108h\+ firmwareAVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which...9.8 Critical
- nuuo nvrmini 2, nvrsolo +1 moreNUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root...9.8 Critical
- vmware photon osVMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys...9.8 Critical
- rockwellautomation 1766-l32awa, 1766-l32awaa, 1766-l32bwa +3 more +5 moreRockwell Automation MicroLogix 1400 PLC 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766...7.3 High
- zmodo zp-ibh-13w, zp-ne-14-s +1 moreZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for...9.8 Critical
- ge multilink firmwareGeneral Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5...9.8 Critical
- schneider electric etg3000 factorycast hmi gateway, schneider-electric etg3000 factorycast hmi gateway firmware, tsxetg3000 +3 more +5 moreSchneider Electric ETG3000 FactoryCast HMI Gateway Use of Hard-coded Credentials10.0
- emerson deltavEmerson DeltaV Use of Hard-coded Credentials2.4
- emerson deltavEmerson DeltaV Use of Improper Authorization6.2
- moxa edr-g903 firmwareMoxa EDR-G903 series routers with firmware before 2.11 have a hardcoded account, which allows...5.0 Medium
- carlo gavazzi automation eos-box, carlosgavazzi eos-box photovoltaic monitoring system, eos-box photovoltaic monitoring system firmware +2 moreCarlo Gavazzi EOS Box Hard-Coded Credentials10.0
- Show moreLoading…