CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- taskautomation carbonftpCarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption...5.5 Medium
- kmccontrols bac-a1616bc firmwareKMS Controls BAC-A1616BC BACnet devices have a cleartext password of snowman in the BACKDOOR_NAME...9.8 Critical
- automobility distribution inc. mycar controlsMyCar Controls uses hard-coded credentials6.5 Medium
- abb cp651-web firmware, cp651 firmware, cp661-web firmware +5 more +7 moreABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts...8.8 High
- billion sg600 r2 firmwareAn exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6...7.8 High
- keycloak, redhat single sign-on +1 morekeycloak vulnerable to unauthorized login via mail server setup9.1 Critical
- cisco data center network managerCisco Data Center Network Manager Authentication Bypass Vulnerabilities9.8 Critical
- cisco data center network managerCisco Data Center Network Manager Authentication Bypass Vulnerabilities9.8 Critical
- cisco data center network managerCisco Data Center Network Manager Authentication Bypass Vulnerabilities9.8 Critical
- intel ipmi, citrix netscaler firmware, netscaler sd-wan firmware +3 more +5 moreIntelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation...8.1 High
- barco clickshare cs-100 firmware, clickshare cse-200\+ firmware, clickshare cse-200 firmware +1 more +3 moreBarco ClickShare Button R9861500D01 devices before 1.9.0 allow Information Exposure. The...5.3 Medium
- petwant pf-103 firmware, skymee petalk ai firmware +1 moreUse of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk...9.8 Critical
- mcollective, debian linux, puppet marionette collective +1 more +3 moremcollective has a default password set at install9.8 Critical
- perforce puppet enterprise, puppet enterprise +1 moreThe express install, which is the suggested way to install Puppet Enterprise, gives the user a...9.8 Critical
- amazon blink xt2 sync module firmwareBlink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary code...6.8 Medium
- grandstream gxv3500 firmware, gxv3501 firmware, gxv3504 firmware +10 more +12 moreGrandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD,...10.0 Critical
- titanhq webtitanAn issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a...9.8 Critical
- titanhq webtitanAn issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root...8.1 High
- freeswitchFreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.9.8 Critical
- jalios jcmsJalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with...9.8 Critical
- fortinet fortios, fortigate +1 moreUse of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup...6.5 Medium
- fortinet forticlient, forticlient for mac os, forticlient for windows +1 more +3 moreUse of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow...5.9 Medium
- zyxel gs1900-10hp firmware, gs1900-16 firmware, gs1900-24 firmware +6 more +8 moreAn issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware...7.5 High
- zyxel gs1900-10hp firmware, gs1900-16 firmware, gs1900-24 firmware +6 more +8 moreAn issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware...5.9 Medium
- medtronic valleylab exchange client, valleylab ft10 energy platform (vlft10gen), valleylab fx8 energy platform (vlfx8gen) +2 more +4 moreMedtronic Valleylab FT10 and FX8 Use of Hard-coded Credentials5.8 Medium
- broadcom brocade sannav, brocade sannav +1 moreBrocade SANnav versions before v2.0 use a hard-coded password, which could allow local...7.8 High
- technicolor c2000t, c2100t, c2000t firmware +1 more +3 moreTechnicolor C2000T and C2100T uses hard-coded cryptographic keys.5.9 Medium
- trms seneca hdn firmwareThe Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a...8.8 High
- ibm security guardium big data intelligenceIBM Security Guardium Big Data Intelligence (SonarG) 4.0 uses hard coded credentials which could...5.9 Medium
- inea me-rtu firmware, mitsubishielectric smartrtu firmware +1 moreAn issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU...9.8 Critical
- inea me-rtu firmware, mitsubishielectric smartrtu firmware +1 moreAn issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU...9.8 Critical
- carel pcoweb firmwareRittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 ? B1.2.4....9.8 Critical
- milesight ip security cameras, ip security camera firmware +1 moreMilesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc...9.8 Critical
- milesight ip security cameras, ip security camera firmware +1 moreMilesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts...9.8 Critical
- milesight ip security cameras, ip security camera firmware +1 moreMilesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that...9.8 Critical
- broadcom ca performance management, ca technologies, a broadcom company performance management, broadcom network operations +2 moreCA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default...9.8 Critical
- cobham plc explorer 710, cobham explorer 710 firmware +1 moreThe root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.089.8 Critical
- zingbox inspectorThe SSH service is enabled on the Zingbox Inspector versions 1.294 and earlier, exposing SSH to...8.4 High
- zingbox inspectorIn the Zingbox Inspector, versions 1.294 and earlier, hardcoded credentials for root and...8.4 High
- broadcom network flow analysisCA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a...9.8 Critical
- sandisk ssd dashboardWestern Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have...7.5 High
- redlion crimsonRed Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a...6.5 Medium
- westerndigital wd my book firmwareWestern Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which...9.8 Critical
- telestar bobs rock radio firmware, dabman d10 firmware, dabman i30 stereo firmware +8 more +10 moreTELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial...9.8 Critical
- ifw8 fr5-e firmware, fr5 firmware, fr6-s firmware +2 more +4 moreifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML...7.5 High
- philips intellivue mp monitors mp20-mp90 firmware, intellivue mp monitors mp2\/x2 firmware, intellivue mp monitors mp5\/5sc firmware +1 more +3 morePhilips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN...7.2 High
- bosch access, access professional edition +1 moreUnauthorized APE administration privileges can be achieved by reverse engineering one of the APE...9.9 Critical
- auna connect 100 firmware, telestar bobs rock radio firmware, dabman d10 firmware +9 more +11 moreTELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial...9.8 Critical
- omaksolutions slick-popupThe slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the...8.8 High
- equeshome elf smart plug firmwareThe Eques elf smart plug and the mobile app use a hardcoded AES 256 bit key to encrypt the...8.8 High
- Show moreLoading…