cve.bz

CWE-798: Use of Hard-coded Credentials, page 3

Filter

The product contains hard-coded credentials, such as a password or cryptographic key.

What the weakness is: CWE-798 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-191 Read Sensitive Constants Within an Executable Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-798, as MITRE names them. Credits.

Ask an AI about CWE-798

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-798: Use of Hard-coded Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/798.html and https://cve.bz/cve/cwe/798?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.7CVE-2026-80134EPSS 0.3%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploi…

  2. 5.5CVE-2026-86276EPSS 0.5%

    A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack c…

  3. 2.0CVE-2026-86150EPSS 0.4%

    A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be l…

  4. 7.1CVE-2026-77847EPSS 0.3%

    Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials.

  5. 6.7CVE-2026-5522EPSS 0.1%

    IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of…

  6. 6.9CVE-2026-85149EPSS 0.4%

    SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby brows…

  7. 9.3CVE-2026-85148EPSS 0.6%

    SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.

  8. 9.3CVE-2026-85146EPSS 0.6%

    SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the applica…

  9. 10.0CVE-2026-75754EPSS 0.3%

    Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service…

  10. 7.1CVE-2026-85451EPSS 0.4%

    MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS proce…

  11. 9.3CVE-2026-85391EPSS 0.6%

    Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary…

  12. 8.7CVE-2024-7952EPSS 0.5%

    A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data.

  13. 9.1CVE-2026-18931EPSS 0.4%

    Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4…

  14. 9.8CVE-2026-38577EPSS 0.5%

    Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access.

  15. 5.5CVE-2026-82808EPSS 0.5%

    A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation…

  16. 9.3CVE-2026-82448EPSS 0.7%

    Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key …

  17. 8.7CVE-2026-19412EPSS 0.3%

    This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with acce…

  18. 9.3CVE-2026-13086EPSS 0.7%

    A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to execute arbitrary code.

  19. 5.3CVE-2026-71396EPSS 0.2%

    Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.

  20. 7.5CVE-2026-37012EPSS 0.5%

    A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

  21. 9.3CVE-2026-78251EPSS 0.4%

    DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, a…

  22. 9.1CVE-2026-75896EPSS 0.4%

    Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5.

  23. 8.6CVE-2026-12587EPSS 0.4%

    The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, the value…

  24. 8.8CVE-2026-59769EPSS 0.6%

    FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number.

  25. 5.5CVE-2026-78062EPSS 0.5%

    A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to…

  26. 6.9CVE-2026-76131EPSS 0.3%

    Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers.

  27. 5.4CVE-2026-76392EPSS 0.2%

    In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because…

  28. 9.3CVE-2026-71960EPSS 0.5%

    Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting t…

  29. 9.8CVE-2021-43717EPSS 0.6%

    An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector malicious…

  30. 8.7CVE-2026-74893EPSS 0.4%

    openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any client_id to gain authenticated access to…

  31. 8.7CVE-2026-74892EPSS 0.5%

    openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to co…

  32. 8.7CVE-2026-74891EPSS 0.5%

    openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive…

  33. 6.6CVE-2026-50601EPSS 0.4%

    A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administr…

  34. 8.2CVE-2026-19901EPSS 0.8%

    A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Atta…

  35. 8.2CVE-2026-19900ExploitEPSS 2.9%

    A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high …

  36. 6.8CVE-2026-73847EPSS 0.2%

    Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attac…

  37. 5.5CVE-2026-63702EPSS 0.1%

    Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

  38. 9.3CVE-2026-19871EPSS 0.5%

    Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email …

  39. 7.2CVE-2026-18164EPSS 0.4%

    An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

  40. 7.5CVE-2026-13460EPSS 0.5%

    IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

  41. 9.3CVE-2026-67614EPSS 1.0%

    CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSoc…

  42. 9.3CVE-2026-59507EPSS 0.3%

    : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Port…

  43. 9.3CVE-2026-73519EPSS 1.2%

    WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this valu…

  44. 7.1CVE-2026-14866EPSS 0.1%

    IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.

  45. 9.3CVE-2026-67568EPSS 0.4%

    The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

  46. 9.3CVE-2026-69102EPSS 0.6%

    MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the pas…

  47. 3.8CVE-2026-58245EPSS 0.3%

    SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with hig…

  48. 9.3CVE-2025-13293EPSS 0.5%

    A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the p…

  49. 7.3CVE-2026-6374EPSS 0.2%

    Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.

  50. 7.5CVE-2026-49007EPSS 0.4%

    By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.