CWE-798: Use of Hard-coded Credentials, page 20

The product contains hard-coded credentials, such as a password or cryptographic key.

What the weakness is: CWE-798 at MITRE

1. 7.5CVE-2022-45425EPSS 0.6%2022-12-27

   Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulnerability.

2. 8.4CVE-2022-36222EPSS 0.3%2022-12-21

   Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface.

3. 5.3CVE-2022-4611EPSS 1.3%2022-12-19

   A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unknown part. The manipulation leads to hard-coded credentials. It is possible to in…

4. 9.8CVE-2022-37832EPSS 0.7%2022-12-16

   Mutiny 7.2.0-10788 suffers from Hardcoded root password.

5. 7.5CVE-2021-35252EPSS 0.6%2022-12-16

   Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext.

6. 9.8CVE-2022-41653EPSS 0.7%2022-12-13

   Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system.

7. 7.5CVE-2022-2660EPSS 0.7%2022-12-13

   Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to decrypt sensitive data and compromise the machine.

8. 6.5CVE-2022-34840EPSS 0.3%2022-12-07

   Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the device. The affected products/versions are as follows: WZR-300HP firmware Ver. 2.00 a…

9. 9.1CVE-2022-38337EPSS 0.8%2022-12-06

   When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are u…

10. 9.8CVE-2022-40259EPSS 0.7%2022-12-05

    MegaRAC Default Credentials Vulnerability

11. 9.8CVE-2022-40242EPSS 0.7%2022-12-05

    MegaRAC Default Credentials Vulnerability

12. 9.8CVE-2022-44097EPSS 0.8%2022-11-30

    Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.

13. 9.8CVE-2022-44096EPSS 0.8%2022-11-30

    Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.

14. 2.1CVE-2022-32967EPSS 0.2%2022-11-29

    RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default password during system reboot triggered by other user, to acquire partial system information such as seria…

15. 9.8CVE-2022-41157EPSS 0.6%2022-11-25

    A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands.

16. 7.5CVE-2022-29831EPSS 1.4%2022-11-25

    Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.

17. 9.1CVE-2022-29830EPSS 1.4%2022-11-25

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.065T allows a remote unauthenticated attack…

18. 7.5CVE-2022-29829EPSS 1.2%2022-11-25

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, Motion Control Setting(GX Works3 related software) versions …

19. 7.5CVE-2022-29828EPSS 1.2%2022-11-25

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view p…

20. 7.5CVE-2022-29827EPSS 1.2%2022-11-25

    Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view p…

21. 7.5CVE-2022-29825EPSS 0.5%2022-11-25

    Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C, and MT Works2 versions from 1.100E to 1.200J allows an unauthenticate…

22. 9.8CVE-2022-40602EPSS 1.1%2022-11-22

    A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured password if the remote administration feature has been enabled by an authentica…

23. 6.5CVE-2021-34577EPSS 0.3%2022-11-09

    In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being adjacent to the device.

24. 7.8CVE-2022-37710EPSS 0.1%2022-11-07

    Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft.Server.Configuration.data > DbEncryptKeyPrimary > Encryption Key. Applicable fi…

25. 7.8CVE-2022-40263EPSS 0.2%2022-11-04

    BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), prote…

26. 8.8CVE-2022-20868EPSS 0.8%2022-11-04

    A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected s…

27. 7.8CVE-2022-26119EPSS 0.2%2022-11-02

    A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.

28. 9.8CVE-2022-29889EPSS 1.5%2022-10-25

    A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with h…

29. 9.8CVE-2022-29477EPSS 1.4%2022-10-25

    An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP header can lead to authentication bypass. An atta…

30. 6.1CVE-2022-38117EPSS 0.3%2022-10-24

    Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users’ ciphertext and tamper with it.

31. 7.4CVE-2021-4228EPSS 9.9%2022-10-24

    Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0.

32. 7.8CVE-2022-42176EPSS 0.3%2022-10-20

    In PCTechSoft PCSecure V5.0.8.xw, use of Hard-coded Credentials in configuration files leads to admin panel access.

33. 5.9CVE-2022-41540EPSS 1.4%2022-10-18

    The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle atta…

34. 9.8CVE-2022-42980EPSS 0.9%2022-10-17

    go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.

35. 7.5CVE-2022-38420EPSS 45%2022-10-14

    Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary service…

36. 7.5CVE-2022-34425EPSS 0.9%2022-10-10

    Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication.

37. 7.5CVE-2022-39273EPSS 0.9%2022-10-06

    FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make ena…

38. 5.3CVE-2022-20844EPSS 0.9%2022-09-30

    A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC using a default static use…

39. 7.5CVE-2020-15327EPSS 1.0%2022-09-29

    Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.

40. 5.3CVE-2020-15326EPSS 0.5%2022-09-29

    Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded certificate for Ejabberd in ejabberd.pem.

41. 9.8CVE-2022-28812EPSS 1.0%2022-09-28

    In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.

42. 9.8CVE-2022-22522EPSS 1.2%2022-09-28

    In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.

43. 8.8CVE-2022-36159EPSS 1.0%2022-09-26

    Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password strength is weak, it can be cracked in few minutes. Through this credential, a malici…

44. 9.8CVE-2022-3214EPSS 2.0%2022-09-16

    Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to  1.9.03.009 have this vulnerability. Executable files could be uploaded to certa…

45. 9.8CVE-2022-38823EPSS 1.1%2022-09-16

    In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.

46. 8.8CVE-2022-35582EPSS 0.9%2022-09-13

    Penta Security Systems Inc WAPPLES 4.0.*, 5.0.0.*, 5.0.12.* are vulnerable to Incorrect Access Control. The operating system that WAPPLES runs on has a built-in non-privileged user penta with a predefined password. The password for this us…

47. 9.8CVE-2022-35413ExploitEPSS 18%2022-09-13

    WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.

48. 7.8CVE-2022-31322EPSS 0.3%2022-09-13

    Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to escalate privileges via overwriting files using SUID flagged executables.

49. 6.1CVE-2022-38069EPSS 0.3%2022-09-13

    Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of …

50. 7.5CVE-2022-37857EPSS 0.5%2022-09-08

    bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-side as well as in clear-text on the android client device by default.