cve.bz

CWE-798: Use of Hard-coded Credentials, page 34

Filter

The product contains hard-coded credentials, such as a password or cryptographic key.

What the weakness is: CWE-798 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-70 Try Common or Default Usernames and Passwords Likelihood: Medium · Severity: High
  • CAPEC-191 Read Sensitive Constants Within an Executable Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-798, as MITRE names them. Credits.

Ask an AI about CWE-798

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-798: Use of Hard-coded Credentials and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/798.html and https://cve.bz/cve/cwe/798?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2018-0468EPSS 0.3%

    A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local attacker to access and alter confidential data. The vulnerability is due to the inst…

  2. 8.1CVE-2018-9083EPSS 1.1%

    In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerabi…

  3. 5.9CVE-2018-9073EPSS 0.5%

    Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.

  4. 9.8CVE-2018-0681EPSS 1.7%

    Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to login to the Management page and change the configuration.

  5. 9.8CVE-2018-0680EPSS 1.7%

    Denbun by NEOJAPAN Inc. (Denbun POP version V3.3P R4.0 and earlier, Denbun IMAP version V3.3I R4.0 and earlier) uses hard-coded credentials, which may allow remote attackers to read/send mail or change the configuration.

  6. 9.8CVE-2018-15439ExploitEPSS 50%

    A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. The vulnerability exists because under specific circumstances,…

  7. 9.8CVE-2018-19069EPSS 2.0%

    An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch …

  8. 9.8CVE-2018-19067EPSS 2.0%

    An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password …

  9. 7.5CVE-2018-19066EPSS 1.6%

    An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is e…

  10. 7.5CVE-2018-19065EPSS 1.6%

    An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is e…

  11. 9.8CVE-2018-19063EPSS 2.0%

    An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password.

  12. 8.8CVE-2018-11062EPSS 1.8%

    Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passwords. These accounts have limited privileges and can access certain system files…

  13. 8.8CVE-2018-10532EPSS 2.4%

    An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70_E1_02.00_19 devices. Hardcoded root SSH credentials were discovered to be stored within the "core_app" binary utilised by the EE router for networking services. An attacker with knowle…

  14. 9.8CVE-2018-13342EPSS 1.1%

    The server API in the Anda app relies on hardcoded credentials.

  15. 9.8CVE-2018-12668EPSS 1.7%

    SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices have a Hard-coded Password.

  16. 8.1CVE-2018-17896EPSS 1.2%

    Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded credentials which may allow an attacker gain unauthorized access to the maintenance functions and obtain…

  17. 9.8CVE-2018-17894EPSS 2.4%

    NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which could allow an attacker to gain privileged access.

  18. 6.5CVE-2018-17919EPSS 1.0%

    All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.

  19. 9.8CVE-2018-5399EPSS 2.1%

    The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of r…

  20. 9.3CVE-2018-1742EPSS 0.3%

    IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of …

  21. 9.8CVE-2018-15427EPSS 6.8%

    A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platforms could allow an unauthenticated, remote attacker to log in to an affected sys…

  22. 9.8CVE-2018-15389EPSS 1.5%

    A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are us…

  23. 7.5CVE-2018-15753EPSS 1.3%

    An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. The use of a Hard-coded DES Cryptographic Key allows an attacker who decodes the application to decrypt transmitted data such as the login us…

  24. 7.5CVE-2018-17217EPSS 0.8%

    An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key.

  25. 9.8CVE-2018-8856EPSS 1.4%

    Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for encryption of internal data.

  26. 9.8CVE-2018-16957EPSS 3.4%

    The Oracle WebCenter Interaction 10.3.3 search service queryd.exe binary is compiled with the i1g2s3c4 hardcoded password. Authentication to the Oracle WCI search service uses this hardcoded password and cannot be customised by customers. …

  27. 8.8CVE-2018-0663EPSS 1.6%

    Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and earlier, TS-WRLP/E firmware Ver.1.09.04 and earlier) use hardcoded credentials which may allow an remote authenticated at…

  28. 5.9CVE-2018-16546EPSS 1.0%

    Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another instal…

  29. 7.5CVE-2018-14901EPSS 1.1%

    The EPSON iPrint application 6.6.3 for Android contains hard-coded API and Secret keys for the Dropbox, Box, Evernote and OneDrive services.

  30. 7.5CVE-2018-13820EPSS 1.4%

    A hardcoded passphrase, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.

  31. 7.5CVE-2018-13819EPSS 1.4%

    A hardcoded secret key, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows attackers to access sensitive information.

  32. 9.8CVE-2018-16158ExploitEPSS 30%

    Eaton Power Xpert Meter 4000, 6000, and 8000 devices before 13.4.0.10 have a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to pe…

  33. 5.9CVE-2018-12240EPSS 1.1%

    The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability that can potentially increase the likelihood of encrypted data being recovered wit…

  34. 9.8CVE-2017-9821EPSS 1.4%

    The National Payments Corporation of India BHIM application 1.3 for Android relies on three hardcoded strings (AK-NPCIMB, IM-NPCIBM, and VK-NPCIBM) for SMS validation, which makes it easier for attackers to bypass authentication.

  35. 9.8CVE-2017-12577EPSS 1.5%

    An issue was discovered on the PLANEX CS-QR20 1.30. A hardcoded account / password ("admin:password") is used in the Android application that allows attackers to use a hidden API URL "/goform/SystemCommand" to execute any command with root…

  36. 9.8CVE-2017-12574EPSS 1.8%

    An issue was discovered on PLANEX CS-W50HD devices with firmware before 030720. A hardcoded credential "supervisor:dangerous" was injected into web authentication database "/.htpasswd" during booting process, which allows attackers to gain…

  37. 9.8CVE-2018-15808EPSS 2.3%

    POSIM EVO 15.13 for Windows includes hardcoded database credentials for the "root" database user. "root" access to POSIM EVO's database may result in a breach of confidentiality, integrity, or availability or allow for attackers to remotel…

  38. 6.2CVE-2018-14801EPSS 0.4%

    In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all se…

  39. 7.5CVE-2018-15491EPSS 1.0%

    A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take control of the whitelisting feature (MyRules2.ini under %LOCALAPPDATA%\Zemana\ZALSDK)…

  40. 7.3CVE-2018-15360EPSS 1.6%

    An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0.

  41. 9.8CVE-2018-11509ExploitEPSS 12%

    ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.

  42. 7.5CVE-2017-13108EPSS 1.0%

    DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  43. 7.5CVE-2017-13107EPSS 1.0%

    Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  44. 7.5CVE-2017-13106EPSS 1.0%

    Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  45. 7.5CVE-2017-13104EPSS 1.0%

    Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  46. 7.5CVE-2017-13102EPSS 1.0%

    Gameloft Asphalt Xtreme: Offroad Rally Racing, 1.6.0, 2017-08-13, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  47. 7.5CVE-2017-13101EPSS 1.0%

    Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  48. 7.5CVE-2017-13100EPSS 1.0%

    DistinctDev, Inc., The Moron Test, 6.3.1, 2017-05-04, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key.

  49. 9.8CVE-2018-14943EPSS 1.5%

    Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account.

  50. 9.8CVE-2018-10592EPSS 6.9%

    Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unautho…