cve.bz

CWE-798: Use of Hard-coded Credentials, page 15

Filter

The product contains hard-coded credentials, such as a password or cryptographic key.

What the weakness is: CWE-798 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-191 Read Sensitive Constants Within an Executable Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-798, as MITRE names them. Credits.

Ask an AI about CWE-798

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-798: Use of Hard-coded Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/798.html and https://cve.bz/cve/cwe/798?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-51588EPSS 0.2%

    Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower Pro. An att…

  2. 9.8CVE-2023-44411EPSS 2.5%

    D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not requi…

  3. 6.5CVE-2023-39482EPSS 1.2%

    Softing Secure Integration Server Hardcoded Cryptographic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Softing Secure Integration Server…

  4. 5.3CVE-2023-39458EPSS 0.2%

    Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA …

  5. 8.8CVE-2023-35724EPSS 0.9%

    D-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2622 routers. Authentication…

  6. 6.3CVE-2023-34284EPSS 0.4%

    NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR RAX30 routers. Authentication is not requir…

  7. 8.8CVE-2023-32145EPSS 0.9%

    D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1360 routers. Authentication is not required t…

  8. 7.5CVE-2024-3544EPSS 0.4%

    Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadM…

  9. 7.1CVE-2023-52723EPSS 0.5%

    In KDE libksieve before 23.03.80, kmanagesieve/session.cpp places a cleartext password in server logs because a username variable is accidentally given a password value.

  10. 4.4CVE-2024-22813EPSS 0.4%

    An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to overwrite the hardcoded IP address in the device memory, disrupting network connectivity between the router and the controller.

  11. 9.8CVE-2024-29966EPSS 0.7%

    Brocade SANnav OVA before v2.3.1 and v2.3.0a contain hard-coded credentials in the documentation that appear as the appliance's root password. The vulnerability could allow an unauthenticated attacker full access to the Brocade SANnav appl…

  12. 3.8CVE-2024-29963EPSS 0.2%

    Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.

  13. 7.5CVE-2024-29960EPSS 0.3%

    In Brocade SANnav server before v2.3.1 and v2.3.0a, the SSH keys inside the OVA image are identical in the VM every time SANnav is installed. Any Brocade SAnnav VM based on the official OVA images is vulnerable to MITM over SSH. An attacke…

  14. 9.8CVE-2024-21990EPSS 0.3%

    ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials.

  15. 9.8CVE-2023-40146EPSS 1.4%

    A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). A specially crafted command line argument can lead to a limited-shell escape and elevated capabilities. An attacker can a…

  16. 7.5CVE-2024-31873EPSS 1.2%

    IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtained by a malicious actor. IBM X-Force ID: 287317.

  17. 5.5CVE-2024-29063EPSS 0.8%

    Azure AI Search Information Disclosure Vulnerability

  18. 9.8CVE-2024-3272KEVExploitEPSS 98%Unsupported when assigned

    A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP…

  19. 5.7CVE-2024-3130EPSS 0.1%

    Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app

  20. 9.8CVE-2024-2161EPSS 0.9%

    Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .

  21. 6.5CVE-2024-22083EPSS 0.6%

    An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. A hardcoded backdoor session ID exists that can be used for further access to the device, including reconfiguration tasks.

  22. 6.5CVE-2024-27774EPSS 0.4%

    Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware

  23. 9.8CVE-2023-38535EPSS 0.3%

    Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryptographic keys.

  24. 9.8CVE-2024-28194EPSS 0.8%

    your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authenti…

  25. 9.8CVE-2023-5456EPSS 0.6%

    A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all included data with the same privileges of the web applic…

  26. 7.5CVE-2024-25731EPSS 0.5%

    The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a binary file. Thus, encryption can be defeated by an attacker who can observe packet data (e.g., ove…

  27. 9.8CVE-2024-24681EPSS 1.0%

    An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). There is a single hardcoded key (used to encrypt provisioning documents) across customers' install…

  28. 5.5CVE-2024-1661EPSS 0.3%

    A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possi…

  29. 9.8CVE-2024-1344EPSS 0.3%

    Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the …

  30. 7.5CVE-2023-6255EPSS 0.4%

    Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable. This issue affects SoliPay Mobile App: before 5.0.8.

  31. 9.8CVE-2024-0390EPSS 0.4%

    INPRAX "iZZi connect" application on Android contains hard-coded MQTT queue credentials. The same MQTT queue is used by corresponding physical recuperation devices. Exploiting this vulnerability could potentially allow unauthorized access …

  32. 7.5CVE-2023-4539EPSS 0.5%

    Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Comarch ERP XL installatio…

  33. 7.7CVE-2023-6409EPSS 0.2%

    CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to a project file protected with application password when opening the file with EcoStruxure Control Expert.

  34. 9.8CVE-2024-23816EPSS 0.7%

    A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non…

  35. 7.8CVE-2024-22313EPSS 0.1%

    IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of inter…

  36. 9.8CVE-2023-38995EPSS 0.8%

    An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.

  37. 9.8CVE-2024-22853EPSS 4.8%

    D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session.

  38. 9.8CVE-2024-21764EPSS 0.6%

    In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a specific port.

  39. 9.8CVE-2023-46706EPSS 0.7%

    Multiple MachineSense devices have credentials unable to be changed by the user or administrator.

  40. 9.8CVE-2024-1039EPSS 0.7%

    Gessler GmbH WEB-MASTER has a restoration account that uses weak hard coded credentials and if exploited could allow an attacker control over the web management of the device.

  41. 9.8CVE-2024-24324EPSS 0.7%

    TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.

  42. 9.8CVE-2023-51840EPSS 0.6%

    DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.

  43. 5.2CVE-2023-6482EPSS 0.1%

    Use of encryption key derived from static information in Synaptics Fingerprint Driver allows an attacker to set up a TLS session with the fingerprint sensor and send restricted commands to the fingerprint sensor. This may allow an attac…

  44. 9.8CVE-2024-23619EPSS 1.7%

    A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to achieve information disclosure or remote code execution.

  45. 5.5CVE-2024-23453EPSS 0.2%

    Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded API key when the application binary is reverse-engineered. This API key may be used for unexpected a…

  46. 7.5CVE-2024-23842EPSS 0.5%

    Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

  47. 7.5CVE-2024-22772EPSS 0.5%

    Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

  48. 7.5CVE-2024-22771EPSS 0.5%

    Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

  49. 7.5CVE-2024-22770EPSS 0.5%

    Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

  50. 7.5CVE-2024-22769EPSS 0.5%

    Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.