CWE-798
Allowed-with-ReviewUse of Hard-coded Credentials
Abstraction: Base · Status: Draft
The product contains hard-coded credentials, such as a password or cryptographic key.
2178 vulnerabilities reference this CWE, most recent first.
GHSA-75H6-MGVV-Q4GR
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default panger123 password for the suma123 account for certain old firmware.
{
"affected": [],
"aliases": [
"CVE-2020-29059"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-24T21:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default panger123 password for the suma123 account for certain old firmware.",
"id": "GHSA-75h6-mgvv-q4gr",
"modified": "2022-05-24T17:34:55Z",
"published": "2022-05-24T17:34:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29059"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7695-F938-C2JF
Vulnerability from github – Published: 2024-01-23 06:30 – Updated: 2025-12-31 03:30Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.
{
"affected": [],
"aliases": [
"CVE-2024-22771"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T05:15:09Z",
"severity": "HIGH"
},
"details": "Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.",
"id": "GHSA-7695-f938-c2jf",
"modified": "2025-12-31T03:30:26Z",
"published": "2024-01-23T06:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22771"
},
{
"type": "WEB",
"url": "http://www.hitron.co.kr/firmware"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-769G-258X-699H
Vulnerability from github – Published: 2024-12-05 15:31 – Updated: 2024-12-05 18:31A vulnerability in the SonicWall SMA100 SSLVPN
firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication.
{
"affected": [],
"aliases": [
"CVE-2024-45319"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-05T14:15:21Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the SonicWall SMA100 SSLVPN \n\nfirmware\u00a010.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication.",
"id": "GHSA-769g-258x-699h",
"modified": "2024-12-05T18:31:02Z",
"published": "2024-12-05T15:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45319"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-76J4-QR57-P9FG
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user's ID and username. These values can be used as part of the comment posting request in order to spoof the user.
{
"affected": [],
"aliases": [
"CVE-2021-33484"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-07T05:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile it, and discover a hardcoded IV used to encrypt the username and userid in the comment POST request. Additionally, the attacker can decrypt the encrypted encryption key (sent as a parameter in the comment form request) by setting this encrypted value as the username, which will appear on the comment page in its decrypted form. Using these two values (combined with the encryption functionality discovered in the decompiled installer), the attacker can encrypt another user\u0027s ID and username. These values can be used as part of the comment posting request in order to spoof the user.",
"id": "GHSA-76j4-qr57-p9fg",
"modified": "2022-05-24T19:13:18Z",
"published": "2022-05-24T19:13:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33484"
},
{
"type": "WEB",
"url": "https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html"
},
{
"type": "WEB",
"url": "https://twitter.com/onyaktech"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-76MR-V53W-7H6C
Vulnerability from github – Published: 2026-04-10 18:31 – Updated: 2026-04-14 15:30An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.
{
"affected": [],
"aliases": [
"CVE-2026-23781"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-10T16:16:30Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.",
"id": "GHSA-76mr-v53w-7h6c",
"modified": "2026-04-14T15:30:33Z",
"published": "2026-04-10T18:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23781"
},
{
"type": "WEB",
"url": "https://docs.bmc.com/xwiki/bin/view/Control-M-Orchestration/Control-M/ctm9022/Patches/Control-M-MFT-PAAFP-9-0-22-025"
},
{
"type": "WEB",
"url": "https://www.bmc.com/support/resources/issue-defect-management.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76R2-4VM6-WFMW
Vulnerability from github – Published: 2022-05-13 01:16 – Updated: 2022-05-13 01:16The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2016-6829"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-12-09T20:59:00Z",
"severity": "CRITICAL"
},
"details": "The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.",
"id": "GHSA-76r2-4vm6-wfmw",
"modified": "2022-05-13T01:16:26Z",
"published": "2022-05-13T01:16:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6829"
},
{
"type": "WEB",
"url": "https://github.com/crowbar/barclamp-trove/commit/932298f250365fed6963700870e52db3a7a32daa"
},
{
"type": "WEB",
"url": "https://github.com/crowbar/crowbar-openstack/commit/208230bdfbcb19d062149d083b1a66b429516a69"
},
{
"type": "WEB",
"url": "https://www.suse.com/security/cve//CVE-2016-6829.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/08/16/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/08/18/9"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92476"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76W9-Q3MJ-JV6H
Vulnerability from github – Published: 2023-12-15 09:30 – Updated: 2023-12-15 09:30Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.
{
"affected": [],
"aliases": [
"CVE-2023-48388"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-15T09:15:08Z",
"severity": "CRITICAL"
},
"details": "Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.",
"id": "GHSA-76w9-q3mj-jv6h",
"modified": "2023-12-15T09:30:18Z",
"published": "2023-12-15T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48388"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7603-b1061-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-775C-WW7W-2C2J
Vulnerability from github – Published: 2024-04-09 18:30 – Updated: 2024-04-09 18:30Azure AI Search Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-29063"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T17:16:00Z",
"severity": "HIGH"
},
"details": "Azure AI Search Information Disclosure Vulnerability",
"id": "GHSA-775c-ww7w-2c2j",
"modified": "2024-04-09T18:30:28Z",
"published": "2024-04-09T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29063"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29063"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-778F-9FXQ-R248
Vulnerability from github – Published: 2022-09-07 00:01 – Updated: 2022-09-09 00:00In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample.
{
"affected": [],
"aliases": [
"CVE-2022-37841"
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-06T17:15:00Z",
"severity": "HIGH"
},
"details": "In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample.",
"id": "GHSA-778f-9fxq-r248",
"modified": "2022-09-09T00:00:49Z",
"published": "2022-09-07T00:01:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37841"
},
{
"type": "WEB",
"url": "https://github.com/1759134370/iot/blob/main/TOTOLINK/A860R/2.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-77P4-47R7-PRGW
Vulnerability from github – Published: 2022-12-06 00:30 – Updated: 2022-12-06 21:30AMI MegaRAC Redfish Arbitrary Code Execution
{
"affected": [],
"aliases": [
"CVE-2022-40259"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-05T22:15:00Z",
"severity": "CRITICAL"
},
"details": "AMI MegaRAC Redfish Arbitrary Code Execution",
"id": "GHSA-77p4-47r7-prgw",
"modified": "2022-12-06T21:30:45Z",
"published": "2022-12-06T00:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40259"
},
{
"type": "WEB",
"url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf"
},
{
"type": "WEB",
"url": "https://cp.ami.com/MegaRAC%20Security%20Advisory/SP-X/AMI_MegaRAC_SPx_Arbitrary_Code_via_Redfish_API.pdf"
},
{
"type": "WEB",
"url": "https://cp.ami.com/MegaRAC%20Security%20Advisory/SP-X/AMI_MegaRAC_SPx_Redfish_Authentication_Vulnerabilities.pdf"
},
{
"type": "WEB",
"url": "https://eclypsium.com/2022/12/05/supply-chain-vulnerabilities-put-server-ecosystem-at-risk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- For outbound authentication: store passwords, keys, and other credentials outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320). If you cannot use encryption to protect the file, then make sure that the permissions are as restrictive as possible [REF-7].
- In Windows environments, the Encrypted File System (EFS) may provide some protection.
Mitigation
For inbound authentication: Rather than hard-code a default username and password, key, or other authentication credentials for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password or key.
Mitigation
If the product must contain hard-coded credentials or they cannot be removed, perform access control checks and limit which entities can access the feature that requires the hard-coded credentials. For example, a feature might only be enabled through the system console instead of through a network connection.
Mitigation
- For inbound authentication using passwords: apply strong one-way hashes to passwords and store those hashes in a configuration file or database with appropriate access control. That way, theft of the file/database still requires the attacker to try to crack the password. When handling an incoming password during authentication, take the hash of the password and compare it to the saved hash.
- Use randomly assigned salts for each separate hash that is generated. This increases the amount of computation that an attacker needs to conduct a brute-force attack, possibly limiting the effectiveness of the rainbow table method.
Mitigation
- For front-end to back-end connections: Three solutions are possible, although none are complete.
- The first suggestion involves the use of generated passwords or keys that are changed automatically and must be entered at given time intervals by a system administrator. These passwords will be held in memory and only be valid for the time intervals.
- Next, the passwords or keys should be limited at the back end to only performing actions valid for the front end, as opposed to having full access.
- Finally, the messages sent should be tagged and checksummed with time sensitive values so as to prevent replay-style attacks.
CAPEC-191: Read Sensitive Constants Within an Executable
An adversary engages in activities to discover any sensitive constants present within the compiled code of an executable. These constants may include literal ASCII strings within the file itself, or possibly strings hard-coded into particular routines that can be revealed by code refactoring methods including static and dynamic analysis.
CAPEC-70: Try Common or Default Usernames and Passwords
An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.