CWE-798: Use of Hard-coded Credentials, page 14
Filter
The product contains hard-coded credentials, such as a password or cryptographic key.
What the weakness is: CWE-798 at MITRE
Related attack patterns (CAPEC): 2
- CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
- CAPEC-191 Read Sensitive Constants Within an Executable Severity: Low
The attack patterns MITRE's CAPEC relates to CWE-798, as MITRE names them. Credits.
Ask an AI about CWE-798
Show the prompt
Explain CWE-798: Use of Hard-coded Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/798.html and https://cve.bz/cve/cwe/798?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2024-35338EPSS 0.5%
Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root.
- 5.3CVE-2024-5810EPSS 0.4%
The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the i…
- 9.1CVE-2024-28751EPSS 0.6%
An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.
- 9.8CVE-2024-28747EPSS 0.7%
An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.
- 9.8CVE-2023-46685EPSS 1.0%
A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specially crafted network packets can lead to arbitrary command execution.
- 9.3CVE-2024-4708EPSS 1.0%
mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.
- 9.8CVE-2023-41919EPSS 0.4%
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access.
- 4.0CVE-2024-38480EPSS 0.2%
"Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerab…
- 9.8CVE-2024-39208EPSS 0.6%
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.
- 9.3CVE-2024-39374EPSS 0.5%
TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed through the use of hard-coded credentials.
- 9.8CVE-2024-0949EPSS 0.5%
Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68.
- 7.5CVE-2024-33329EPSS 0.7%
A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information.
- 8.1CVE-2024-5460EPSS 0.5%
A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Brocade Fabric OS versions before v9.0.0 could allow an authenticated, remote attacker to read data from an affected device via SNM…
- 9.3CVE-2023-6198EPSS 0.4%
Use of Hard-coded Credentials vulnerability in Baicells Snap Router BaiCE_BMI on EP3011 (User Passwords modules) allows unauthorized access to the device.
- 7.5CVE-2024-36496EPSS 0.7%
The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algo…
- 9.8CVE-2024-36480EPSS 0.4%
Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, uninte…
- 8.8CVE-2024-6045EPSS 6.3%
Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by usin…
- 9.8CVE-2024-38466EPSS 0.4%
Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.
- 7.4CVE-2024-27170EPSS 0.3%
It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the refe…
- 7.1CVE-2024-27168EPSS 0.3%
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see…
- 6.2CVE-2024-27161EPSS 0.2%
all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed…
- 6.2CVE-2024-27160EPSS 0.2%
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities…
- 6.2CVE-2024-27159EPSS 0.3%
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities…
- 8.8CVE-2024-37630EPSS 0.4%
D-Link DIR-605L v2.13B01 was discovered to contain a hardcoded password vulnerability in /etc/passwd, which allows attackers to log in as root.
- 8.6CVE-2024-38281EPSS 0.4%
An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.
- 7.8CVE-2024-0865EPSS 0.2%
CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user.
- 9.0CVE-2024-29855EPSS 22%
Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator
- 9.3CVE-2024-3700EPSS 0.4%
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Simple Care software installations. This issue affects Estomed Sp. z o.o. Simple…
- 9.3CVE-2024-3699EPSS 0.4%
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all drEryk Gabinet installations.This issue affects drEryk Gabinet software versions …
- 9.3CVE-2024-1228EPSS 0.4%
Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is the same among all Eurosoft Przychodnia installations. This issue affects Eurosoft Przychodnia soft…
- 8.0CVE-2023-49224EPSS 0.3%
Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file. A remote attacker could use this key to gain root privileges.
- 8.8CVE-2023-49223EPSS 0.3%
Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stored in /etc/passwd. An attacker could exploit this to extract files and obtain sensitive information.
- 8.8CVE-2023-49222EPSS 0.3%
Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to gain root privileges.
- 7.8CVE-2023-49221EPSS 0.2%
Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and access the service menu, because there is a hard-coded service code.
- 9.8CVE-2024-3408ExploitEPSS 78%
man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attacker…
- 8.1CVE-2024-29170EPSS 0.3%
Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. An adjacent network unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure of net…
- 9.8CVE-2024-36782EPSS 0.4%
TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.
- 9.8CVE-2024-5514EPSS 0.7%
MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control…
- 6.5CVE-2024-36049EPSS 0.5%
Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the database server, using an unencrypted connection. This allows attackers in a machin…
- 9.8CVE-2024-35396EPSS 0.5%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root.
- 7.5CVE-2024-32988EPSS 0.4%
'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. Secret key for JWT may be retrieved if the application binary is reverse-engineered.
- 7.5CVE-2024-4844EPSS 0.2%
Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing…
- 9.8CVE-2024-32053EPSS 0.5%
Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. This could result in an attacker gaining access to services with the privileges of a Powerpanel bu…
- 9.6CVE-2024-27107EPSS 0.3%
Weak account password in GE HealthCare EchoPAC products
- 9.8CVE-2024-32740EPSS 0.7%
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains undocumented users and credentials. An attacker could misuse the credentials to compromise the device locally or over the network.
- 8.6CVE-2024-34219EPSS 21%
TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.
- 9.8CVE-2024-31810EPSS 0.6%
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- 9.8CVE-2024-23473EPSS 1.1%
The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initi…
- 8.6CVE-2023-26566EPSS 0.7%
Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sen…
- 8.8CVE-2023-51629EPSS 3.9%
D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not r…