CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- gameloft asphalt xtreme: offroad rally racing, asphalt xtreme +1 moreGameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption7.5 High
- musical.ly inc. musical.lyMusical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption7.5 High
- distinctdev the moron testDistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption7.5 High
- harmonicinc nsg 9000 firmwareHarmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default...9.8 Critical
- yokogawa stardom fcj controllers, fcj firmware, fcn-100 firmware +5 more +7 moreYokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU...9.8 Critical
- [unknown] openstack-tripleo-heat-templates, redhat openstack, openstack tripleo heat templates +2 moreA vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When...8.8 High
- ibm bladecenter hs22 firmware, bladecenter hs23 firmware, bladecenter hs23e firmware +35 more +37 moreThe IMM2 First Failure Data Capture function collects management module logs and diagnostic...7.5 High
- [unknown] pki-core, dogtagpki, redhat enterprise linux desktop +2 more +4 moreIt was found that a mock CMC authentication plugin with a hardcoded secret was accidentally...5.9 Medium
- cisco policy suite, mobility services engine +1 moreA vulnerability in the Cluster Manager of Cisco Policy Suite before 18.2.0 could allow an...9.8 Critical
- oracle glassfish serverThe demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default...9.8 Critical
- hughes satellite modem dw7000, hn7000s/sm, hn7740s +4 more +6 moreHughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials8.8 High
- juniper contrail service orchestrationContrail Service Orchestration: Hardcoded credentials for Keystone service.9.8 Critical
- juniper contrail service orchestrationContrail Service Orchestration: hardcoded cryptographic certificates and keys9.8 Critical
- juniper contrail service orchestrationContrail Service Orchestration: Hardcoded credentials for Grafana service6.5 Medium
- juniper contrail service orchestrationJuniper Networks Contrail Service Orchestration releases prior to 3.3.0 have Cassandra service...9.8 Critical
- universal robots robot controller version cb 3.1, sw version 3.4.5-100, universal-robots cb3.1 firmware +1 moreUniversal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded...9.8 Critical
- dialogic powermedia xmsUse of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the...9.8 Critical
- dialogic powermedia xmsUse of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms...9.8 Critical
- medtronic 24950 mycarelink monitor, 24952 mycarelink monitor, 24950 mycarelink monitor firmware +1 more +3 moreMedtronic MyCareLink Patient Monitor Use of Hard-coded Password6.4 Medium
- eztcp cie-h10 firmware, cie-h12 firmware, cie-h14 firmware +5 more +7 moreSollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of...9.8 Critical
- siemens rapidlab 1200 firmware, rapidpoint 400 firmware, rapidpoint 500 firmware +1 more +3 moreA vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems /...9.8 Critical
- telesquare sdt-cs3b1 firmware, sdt-cw3b1 firmware +1 moreTelesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote...9.8 Critical
- d-link dir-620 firmwareIn the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of...9.8 Critical
- dlink dir-620 firmwareD-Link DIR-620 devices, with a certain Rostelekom variant of firmware 1.0.37, have a hardcoded...9.8 Critical
- apollotechnologiesinc momentum axel 720p, momentum axel 720p firmware +1 moreAn issue was discovered on Momentum Axel 720P 5.1.8 devices. A password of EHLGVG is hard-coded...6.8 Medium
- cisco wide area application servicesA vulnerability in the default configuration of the Simple Network Management Protocol (SNMP)...5.3 Medium
- gamerpollsAn issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config...7.3 High
- aprendecondedos dedos-webIn Dedos-web 1.0, the cookie and session secrets used in the Express.js application have...7.3 High
- lutron stanza, homeworks qs firmware, radiora 2 firmware +1 more +3 more** DISPUTED ** Default and unremovable support credentials allow attackers to gain total super...9.8 Critical
- lutron homeworks qs firmware, radiora 2 firmware, stanza firmware +2 more** DISPUTED ** Default and unremovable support credentials (user:nwk password:nwk2) allow...9.8 Critical
- lutron homeworks qs firmware, radiora 2 firmware, stanza firmware +2 more** DISPUTED ** Default and unremovable support credentials (user:lutron password:integration)...9.8 Critical
- tp-link ipc tl-ipc223\(p\)-6 firmware, tl-ipc323k-d firmware, tl-ipc325\(kp\) firmware +1 more +3 more/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL...9.8 Critical
- myscada myproA hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO...9.1 Critical
- cisco digital network architecture centerA vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated...10.0 Critical
- intelbras ncloud 300 firmwareAn issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform...9.8 Critical
- foxconn ap-fc4064-t firmwareA low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO...9.8 Critical
- red lion controls sixnet-managed industrial switches, automationdirect stride-managed ethernet switch models, redlion sixnet-managed industrial switches firmware +1 more +3 moreA hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed...10.0 Critical
- fortinet fortiwlcThe presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain...9.8 Critical
- fortinet fortiwlcThe presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to...9.8 Critical
- rangerstudio directusDirectus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT...9.8 Critical
- philips brilliance ct big bore firmware, brilliance ct scanners, brilliance firmware 64 +2 more +4 morePhilips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4...7.8 High
- tp-link eap controllerThe web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5...7.5 High
- meross mss110 firmwareMeross MSS110 devices before 1.1.24 contain a TELNET listener providing access for an...9.8 Critical
- boston scientific zoom latitude prm, bostonscientific zoom latitude prm 3120 firmware +1 moreBoston Scientific ZOOM LATITUDE PRM Model 3120 uses a hard-coded cryptographic key to encrypt PHI...4.6 Medium
- watchguard ap100 firmware, ap102 firmware, ap200 firmware +2 moreAn issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9...9.8 Critical
- philips dosewise, dosewise portal +1 moreThe backend database of the Philips DoseWise Portal application versions 1.1.7.333 and 2.1.1.3069...9.1 Critical
- momentum axel 720p firmwareMomentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account,...7.4 High
- schneider electric se modicon premium, modicon quantum, modicon m340, bmxnor0200, schneider-electric 140cpu31110 firmware, 140cpu31110c firmware +55 more +57 moreHard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340,...9.8 Critical
- juniper junos spaceThe MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with...9.8 Critical
- moxa, moxa awk-3131a firmware +1 moreAn exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless...10.0 Critical
- Show moreLoading…